[CLSA-2026:1786373407] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-10 14:50:21 UTC
Description:
* CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an end-of-stream code * CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-74_amd64.deb
    sha:c252e4b3d748fa27b930ca85bbbf83ee3071a455
  • alt-php73-bcmath_7.3.33-74_amd64.deb
    sha:45f428ee8d8c014251436c9311dff686754b9638
  • alt-php73-cli_7.3.33-74_amd64.deb
    sha:37d43aafe6b03ec32fc82bbc12415945d5f42f8d
  • alt-php73-common_7.3.33-74_amd64.deb
    sha:8315de9650eef4f0a33120e91edab524c934f8cb
  • alt-php73-dba_7.3.33-74_amd64.deb
    sha:2d307f3308f58cfb161318d758db78e39051194e
  • alt-php73-dev_7.3.33-74_amd64.deb
    sha:189af0a1f9105bbcb98e2ab16e3bf76c7c068170
  • alt-php73-enchant_7.3.33-74_amd64.deb
    sha:648d4e518d30b456d8ddfa124a94fb560225d9dc
  • alt-php73-firebird_7.3.33-74_amd64.deb
    sha:e41a2a9284637d2f5a998ce9fd86134724f71b08
  • alt-php73-gd_7.3.33-74_amd64.deb
    sha:04d7d5769b5637ac6938861917ea732a9f99cbe5
  • alt-php73-imap_7.3.33-74_amd64.deb
    sha:c6d94ae49fb5a101bd5ced0262f0b5af7ab0bfce
  • alt-php73-intl_7.3.33-74_amd64.deb
    sha:c0cca751838b452f0a9dbfc250d5776d34772f85
  • alt-php73-ldap_7.3.33-74_amd64.deb
    sha:b6039b51a7ab9b5578dc302dbb8db3905dbf1f91
  • alt-php73-mbstring_7.3.33-74_amd64.deb
    sha:fd97ff95ea0875a0b3c8065ae5416281ccfe7ad8
  • alt-php73-mysqlnd_7.3.33-74_amd64.deb
    sha:1147d8d068cca1bc8e0c6c4560842cd722bcddb8
  • alt-php73-odbc_7.3.33-74_amd64.deb
    sha:3d67549c2ce5780d80ef47b4ab0a3a266180b219
  • alt-php73-opcache_7.3.33-74_amd64.deb
    sha:1796743f55629187127a54daef6de2ca8acab138
  • alt-php73-pdo_7.3.33-74_amd64.deb
    sha:8630df258858d272acb1efaf24a931ad82e5eda4
  • alt-php73-pgsql_7.3.33-74_amd64.deb
    sha:ccfb735b94701534219ff101d7019c85b902a755
  • alt-php73-php-fpm_7.3.33-74_amd64.deb
    sha:067f8f0c4b9f2c7e9fe812bef094392bd3b8871b
  • alt-php73-process_7.3.33-74_amd64.deb
    sha:859c9da41928d64792ec381117f4910de621056d
  • alt-php73-pspell_7.3.33-74_amd64.deb
    sha:05f6b98184f8cb8d866ec5d6d3ba22b840feabe2
  • alt-php73-recode_7.3.33-74_amd64.deb
    sha:f167acec2315878874e56eca102ab0b376586968
  • alt-php73-snmp_7.3.33-74_amd64.deb
    sha:173051579b0d89366bc291c23852b74a3f5039e4
  • alt-php73-soap_7.3.33-74_amd64.deb
    sha:c8ff4aac358d4e76dd751adadc244339be390c35
  • alt-php73-sodium_7.3.33-74_amd64.deb
    sha:80a49d371c23c235110681f1272c3c40e873253c
  • alt-php73-tidy_7.3.33-74_amd64.deb
    sha:921b4046cb8acfcfb26ccec44f14904cb5ab57d8
  • alt-php73-xml_7.3.33-74_amd64.deb
    sha:b1a0f505469b09677992793abfdac775dced68f4
  • alt-php73-xmlrpc_7.3.33-74_amd64.deb
    sha:af118a58e5f1ae02df27770864b5a8f8c30829ed
  • alt-php73_7.3.33-74_arm64.deb
    sha:0e87db9d94d7fbf27be490b1916b06289a9ac759
  • alt-php73-bcmath_7.3.33-74_arm64.deb
    sha:18bd9a9619972f55a60877c8c2c6bc4ff416190f
  • alt-php73-cli_7.3.33-74_arm64.deb
    sha:8c7c9f8d3578563d42d53835561def2bc695baef
  • alt-php73-common_7.3.33-74_arm64.deb
    sha:7b94657e61f01c8ae1c9d42b0ee5bc5564daf2ce
  • alt-php73-dba_7.3.33-74_arm64.deb
    sha:3795f389cdc8d06e45e644ecdd5ffaee63bfd451
  • alt-php73-dev_7.3.33-74_arm64.deb
    sha:6a24f03c08a6b3d8974d730423935eb0d135492a
  • alt-php73-enchant_7.3.33-74_arm64.deb
    sha:855a1b7cf13d09857b4708b4bad5df4bb6017594
  • alt-php73-firebird_7.3.33-74_arm64.deb
    sha:39cc12cd743ca7a31ebf93dee72001c1680f7552
  • alt-php73-gd_7.3.33-74_arm64.deb
    sha:b8a5462c9804b26d881eb844d746c48e720d27cc
  • alt-php73-imap_7.3.33-74_arm64.deb
    sha:70175875047e0fbe7f587b4930f6030efb2aef8f
  • alt-php73-intl_7.3.33-74_arm64.deb
    sha:a64ec0763a91c34675451a345e8c1b6457e9cd83
  • alt-php73-ldap_7.3.33-74_arm64.deb
    sha:2127cce19d1077852497f1ceedc92f9eac541062
  • alt-php73-mbstring_7.3.33-74_arm64.deb
    sha:4c8f673fb95008133be58d0b2b51896baee68e9f
  • alt-php73-mysqlnd_7.3.33-74_arm64.deb
    sha:843ef9a220dfc18967c58fced7ed16ee48cba130
  • alt-php73-odbc_7.3.33-74_arm64.deb
    sha:47071ecada4cb672920589e5cac43bb85d1c1467
  • alt-php73-opcache_7.3.33-74_arm64.deb
    sha:5726dfc4d978a882a1f1065a54814bb3b315cb79
  • alt-php73-pdo_7.3.33-74_arm64.deb
    sha:20c54c268e61aeb64f1462cccbb0464108176885
  • alt-php73-pgsql_7.3.33-74_arm64.deb
    sha:5e69524e1874471f8cde2abd8bd3c892f5e642ed
  • alt-php73-php-fpm_7.3.33-74_arm64.deb
    sha:d913678ee3cc8ec7ef93694a3a6c1cafb5f1a884
  • alt-php73-process_7.3.33-74_arm64.deb
    sha:903dd92510b4cc75046477b89ca1bf8051f857d7
  • alt-php73-pspell_7.3.33-74_arm64.deb
    sha:416d2826366de1fafb9b9cc2b5e7e88838e17670
  • alt-php73-recode_7.3.33-74_arm64.deb
    sha:2d96cc60b12c2615231358f2f74a4fafa308a7fd
  • alt-php73-snmp_7.3.33-74_arm64.deb
    sha:e0d363edea4c3229a955a38b8ffcc45d06788e03
  • alt-php73-soap_7.3.33-74_arm64.deb
    sha:7ba4385f2a9250a06454e58ff1afb83a9669de2d
  • alt-php73-sodium_7.3.33-74_arm64.deb
    sha:24bea7318829d0178c17ca38085bc5d1777ab55a
  • alt-php73-tidy_7.3.33-74_arm64.deb
    sha:957967af3a68eeccc6c9f59c48b3f933ee4697ee
  • alt-php73-xml_7.3.33-74_arm64.deb
    sha:92878abf49d62f766ecb64351af5b3030ccf2d06
  • alt-php73-xmlrpc_7.3.33-74_arm64.deb
    sha:b4db2fbad6415c021309c8fffae58513ec274dd3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.