[CLSA-2026:1786375126] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-10 15:18:58 UTC
Description:
* CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped values escaped by PQescapeStringConn() in an E'...' escape-string constant, but that escaper leaves backslashes untouched when standard_conforming_strings is on, so a trailing backslash escaped the doubling quote and broke out of the literal. Drop the E prefix so the plain '...' form matches what the escaper produces. * CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed symlink chains by tail recursion with no cycle or depth guard, so a tar phar holding circular links exhausted the C stack. Walk the chain iteratively with Floyd cycle detection and return NULL on a loop; also restore the '/' separator in phar_get_link_location() so the walk stays idempotent.
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-29_amd64.deb
    sha:18c54554590c9d850d7b4ad2af7501830f8a4d5b
  • alt-php81-bcmath_8.1.34-29_amd64.deb
    sha:b3a0533899cf308362c81905d622155dbe1dd3df
  • alt-php81-cli_8.1.34-29_amd64.deb
    sha:7c52dbee936a00fb37c053779afec87c25908ce9
  • alt-php81-common_8.1.34-29_amd64.deb
    sha:9c9b21f3900955311fe2d7e32e100dd5574e5a0c
  • alt-php81-dba_8.1.34-29_amd64.deb
    sha:e95044e4fb11b88e2f4db48864b53bf974c1fc51
  • alt-php81-dev_8.1.34-29_amd64.deb
    sha:fb2c0f0673f1488a38614b49df6eebfd15b02a0d
  • alt-php81-enchant_8.1.34-29_amd64.deb
    sha:03fc57da1fd1646d5b5e773df2e2bbfa0fd6c581
  • alt-php81-firebird_8.1.34-29_amd64.deb
    sha:37319ec3753dd5a343bc6ee6e297a89d7db2cdce
  • alt-php81-gd_8.1.34-29_amd64.deb
    sha:1e8a3329c5f1b079848999c132157fdafef9aed9
  • alt-php81-imap_8.1.34-29_amd64.deb
    sha:2c7d307c54c1d81a49a5d330d10135f74bcf0df0
  • alt-php81-intl_8.1.34-29_amd64.deb
    sha:029ad324464d5830b869ee024eb059d76ae111c1
  • alt-php81-ldap_8.1.34-29_amd64.deb
    sha:a42b68ad1e1e7ff29b124f25b5ea66a0a785e7e6
  • alt-php81-mbstring_8.1.34-29_amd64.deb
    sha:1c89f9b9ccd71215e8add918c76b8fab7939e8d8
  • alt-php81-mysqlnd_8.1.34-29_amd64.deb
    sha:7f4571e4c9429415d13e2eebfef6da1f3f1c7aa9
  • alt-php81-odbc_8.1.34-29_amd64.deb
    sha:ca4b73cb4d9894f607c772a8a285e32fc967dedd
  • alt-php81-opcache_8.1.34-29_amd64.deb
    sha:298aa8c1045da2d6d57add5bde2619516f52e7b9
  • alt-php81-pdo_8.1.34-29_amd64.deb
    sha:de7c3dd368a28f403f468e74fbbf60394c6e0fea
  • alt-php81-pgsql_8.1.34-29_amd64.deb
    sha:0aa585b9824726935076555c0c3fefe069fce79d
  • alt-php81-php-fpm_8.1.34-29_amd64.deb
    sha:2b9d0b3c221b083652e684fc5a11984b006834e6
  • alt-php81-process_8.1.34-29_amd64.deb
    sha:0c42a682403d3329c7d7b512709cc29751d5b98a
  • alt-php81-pspell_8.1.34-29_amd64.deb
    sha:61a8a2f5a419f1ab4c022018ee3664468125fd9f
  • alt-php81-snmp_8.1.34-29_amd64.deb
    sha:8fb99ceb58e7ae802102ea04feb9dd48aaf40419
  • alt-php81-soap_8.1.34-29_amd64.deb
    sha:75dc6dd803ce0174ba9df412f416475f66440e2d
  • alt-php81-sodium_8.1.34-29_amd64.deb
    sha:16e37875b76dda9d6d585ed3bde855f412d139dc
  • alt-php81-tidy_8.1.34-29_amd64.deb
    sha:c3bf0c7954dc531ceee62bcf8d4977157488ddfd
  • alt-php81-xml_8.1.34-29_amd64.deb
    sha:b333f620a377ee3ce3d9828989ac89b148bc9067
  • alt-php81_8.1.34-29_arm64.deb
    sha:540efa280cd81b9c6097ff3d59495bcbd3c21053
  • alt-php81-bcmath_8.1.34-29_arm64.deb
    sha:08d3eea83def99e84ffe23648213bf31fbd1addb
  • alt-php81-cli_8.1.34-29_arm64.deb
    sha:051eca84ad72314dc2640adf00dd0cc569db0ae4
  • alt-php81-common_8.1.34-29_arm64.deb
    sha:6b0d3bcda472a97ebda31696882ba6c5b14844f9
  • alt-php81-dba_8.1.34-29_arm64.deb
    sha:16d395bfc0ef82b0db5de0afe0bf207442d5bca2
  • alt-php81-dev_8.1.34-29_arm64.deb
    sha:39948e1ead21e2653fe717a8820acb2c373b95cb
  • alt-php81-enchant_8.1.34-29_arm64.deb
    sha:4d72e15c1ce67d63397b4675cfaf7cafc1cd9b29
  • alt-php81-firebird_8.1.34-29_arm64.deb
    sha:b7563b39dd46acd85ab654ffdea4fe4cf71470c2
  • alt-php81-gd_8.1.34-29_arm64.deb
    sha:e14a15f7b0e31765184a125dd04880549c379bf3
  • alt-php81-imap_8.1.34-29_arm64.deb
    sha:e9af96ada06d5033a81bd4e5764a675a4d5a5269
  • alt-php81-intl_8.1.34-29_arm64.deb
    sha:64e0f89e85d58c8135675dddccb9d68aead22e25
  • alt-php81-ldap_8.1.34-29_arm64.deb
    sha:3b4db0d55489259af9e75c4bdcd80ec4060b80ee
  • alt-php81-mbstring_8.1.34-29_arm64.deb
    sha:77974ebafd528f9732edc4680c42f5a8f0425e56
  • alt-php81-mysqlnd_8.1.34-29_arm64.deb
    sha:2c8a4121f9c67116d294705a632ad40b30321914
  • alt-php81-odbc_8.1.34-29_arm64.deb
    sha:2aa6fad235ed14cce6464595a96bf71ba064ca3c
  • alt-php81-opcache_8.1.34-29_arm64.deb
    sha:cd3fed00c3ec7c80e9f2e285ab772bcc4a07beac
  • alt-php81-pdo_8.1.34-29_arm64.deb
    sha:25d96e57c8a408397e839bf9d0b6a20e77836737
  • alt-php81-pgsql_8.1.34-29_arm64.deb
    sha:e5f814f003e94d2804d8b5f94d0aa76b0406c452
  • alt-php81-php-fpm_8.1.34-29_arm64.deb
    sha:767390716316c3abdb5fa8f3f932dd8081ba3480
  • alt-php81-process_8.1.34-29_arm64.deb
    sha:79a2f7a509b35e75783fb17fae51dce168538d3f
  • alt-php81-pspell_8.1.34-29_arm64.deb
    sha:7778589672ea3dd7b36bad8f36fe95a4b5778b97
  • alt-php81-snmp_8.1.34-29_arm64.deb
    sha:47e202792c96fb4799d4e6d6eab49c871e476029
  • alt-php81-soap_8.1.34-29_arm64.deb
    sha:d545db90c05be59b627c14eabc36fdca5c0406bb
  • alt-php81-sodium_8.1.34-29_arm64.deb
    sha:c0238f15b1c59520a5765d3cea97d2e537e9587a
  • alt-php81-tidy_8.1.34-29_arm64.deb
    sha:b4f3449ed00eac4147f1de5295205bf4b1a76f7a
  • alt-php81-xml_8.1.34-29_arm64.deb
    sha:9363f10255fe0e204c5bff309e666625aab0dfba
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.