[CLSA-2026:1786393360] Fix CVE(s): CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Important
Release date:
2026-08-11 10:02:59 UTC
Description:
* SECURITY UPDATE: bundled libgd GIF LZW decoder defects reachable from attacker-controlled GIF data via imagecreatefromgif() and friends - debian/patches/php-5.3-CVE-2026-9672.patch: in ext/gd/libgd/gd_gif_in.c, reset table[1][i] instead of repeatedly clearing table[1][0] when clearing the LZW table, return early once the LZW end code is seen instead of falling through with a stale code, and zero-initialise the LZW_STATIC_DATA scratch struct in ReadImage() - CVE-2026-9672 * SECURITY UPDATE: phar stack exhaustion (unbounded recursion) on circular symlink chains in tar-based archives (GHSA-vc5h-9ppw-p5f3) - debian/patches/php-5.3-CVE-2026-7260.patch: phar_get_link_source() in ext/phar/util.c resolved links by recursing into itself with no cycle detection; walk the chain iteratively with Floyd cycle detection over a new phar_follow_one_link() helper and return NULL on a cycle, and restore the path separator in phar_get_link_location() so that helper is idempotent across the two cursors - CVE-2026-7260
CVEs fixed:
Updated packages:
  • alt-php53_5.3.29-209_amd64.deb
    sha:698bc44ce470d9c12c017f75ddf2f1a80395e214
  • alt-php53-bcmath_5.3.29-209_amd64.deb
    sha:b174535589f846c6c9b12f158863d004990943a1
  • alt-php53-cli_5.3.29-209_amd64.deb
    sha:86c3ceca49490d65cc230f03a378457cb6dbd3b3
  • alt-php53-common_5.3.29-209_amd64.deb
    sha:5012fd6af748d049f2676fc1e28898385424f807
  • alt-php53-dba_5.3.29-209_amd64.deb
    sha:cfeee872d1201e0f49c363770b4645a3d4798a87
  • alt-php53-dbx_5.3.29-209_amd64.deb
    sha:84d067773707e74333cecab76d8dc378ab84453b
  • alt-php53-dev_5.3.29-209_amd64.deb
    sha:17100f03174b44500f66dd71210cbff4fbfc03ca
  • alt-php53-enchant_5.3.29-209_amd64.deb
    sha:4f8fedc2403db78a2276c6570b328b571e7fc995
  • alt-php53-firebird_5.3.29-209_amd64.deb
    sha:f755aa69a08c1611637703ea65229f892ca96a6f
  • alt-php53-gd_5.3.29-209_amd64.deb
    sha:08687a41e8723322bdcde6074ac91ce7c954a739
  • alt-php53-imap_5.3.29-209_amd64.deb
    sha:5af608f71d8366bd6fc21e6f2bfe3c2491a77cde
  • alt-php53-intl_5.3.29-209_amd64.deb
    sha:b221bc7778b4bf5553cd6c41614ce6b27d920eba
  • alt-php53-ldap_5.3.29-209_amd64.deb
    sha:52ca61176fac98db95077f196ff60c088e4783f7
  • alt-php53-mbstring_5.3.29-209_amd64.deb
    sha:e8e3a6f4d8ae6f10a76ce388d73275ec6e59c1b9
  • alt-php53-mcrypt_5.3.29-209_amd64.deb
    sha:ae6e1c6ebd06901aaf017621ff3750bb8e2d4f41
  • alt-php53-mssql_5.3.29-209_amd64.deb
    sha:c0d95f76fd52463839ca81406d0f9c6ebbc6c063
  • alt-php53-mysqlnd_5.3.29-209_amd64.deb
    sha:86f0ae3d1ad2fd1c12530bb5b01928e6ccd5e273
  • alt-php53-odbc_5.3.29-209_amd64.deb
    sha:5c0e193c7d7ce3d60e774430ff2732629bc81100
  • alt-php53-pdo_5.3.29-209_amd64.deb
    sha:a0619cf3862a82b07b48072314a2672ca7d6372a
  • alt-php53-pgsql_5.3.29-209_amd64.deb
    sha:ee7f47ca6df780936f7f4fea87097b2f7bf07e51
  • alt-php53-php-fpm_5.3.29-209_amd64.deb
    sha:e1d504d61215efe6bd193285fe6f63f8b175696a
  • alt-php53-process_5.3.29-209_amd64.deb
    sha:01c4979e6d6e0beb77e25eb43455833617166c4b
  • alt-php53-pspell_5.3.29-209_amd64.deb
    sha:9cd041538f9c88f6fe2ac2267fa611e02e1d9daa
  • alt-php53-recode_5.3.29-209_amd64.deb
    sha:23a97c8b42cbd88292d34c094a6a5fc18c01dd69
  • alt-php53-snmp_5.3.29-209_amd64.deb
    sha:963ecbaf083dd64e82a43902d98e5007a28077ce
  • alt-php53-soap_5.3.29-209_amd64.deb
    sha:d54bf89520839c74deb0f489ae7628e87d3f6393
  • alt-php53-sybase_5.3.29-209_amd64.deb
    sha:661cdad31f7e467d4d808e0395163d62105234d2
  • alt-php53-tidy_5.3.29-209_amd64.deb
    sha:c9ead275572bb3d1d66bddf515dfa8c5b20a0370
  • alt-php53-xml_5.3.29-209_amd64.deb
    sha:cde49ddff462f1ad71eb54f57cd96523cbd6c5e0
  • alt-php53-xmlrpc_5.3.29-209_amd64.deb
    sha:26aa1f6dc96003ad67f6e4e88d6e284054a106e3
  • alt-php53_5.3.29-209_arm64.deb
    sha:b1f61581a55e5897242ca226a0a55daf014d3758
  • alt-php53-bcmath_5.3.29-209_arm64.deb
    sha:4248f85546d0892d9fea17428d07c6ea7f54263a
  • alt-php53-cli_5.3.29-209_arm64.deb
    sha:3310361ec457b2a57a052a44d5df332d9603df6b
  • alt-php53-common_5.3.29-209_arm64.deb
    sha:722f20fc4c7303aa2ab96020efa9acd9fb3145c8
  • alt-php53-dba_5.3.29-209_arm64.deb
    sha:2144e31f0eb2d2b695f742f25ab22751aaf23401
  • alt-php53-dbx_5.3.29-209_arm64.deb
    sha:3763c205b75ef9be65077281ea76fdee56c5656b
  • alt-php53-dev_5.3.29-209_arm64.deb
    sha:7a8615360a8bc77d31803f48d973b9023156293a
  • alt-php53-enchant_5.3.29-209_arm64.deb
    sha:cefd12afeadfaed4ddd88d7afa4e1b82ba0136c6
  • alt-php53-firebird_5.3.29-209_arm64.deb
    sha:f2520b2136ecb6edb34737293e69cc0a036aaed0
  • alt-php53-gd_5.3.29-209_arm64.deb
    sha:09c2ef61faf4aab5e800bb453676a6de3bbcbd60
  • alt-php53-imap_5.3.29-209_arm64.deb
    sha:65490d0d34113fb21a0e139a81a9cf1cc1f1db4c
  • alt-php53-intl_5.3.29-209_arm64.deb
    sha:0af5391e78e5c6a8cadcbc97c4994ee562df183e
  • alt-php53-ldap_5.3.29-209_arm64.deb
    sha:3c2ae8affa25c8706663ba23c49577c436c9aa8e
  • alt-php53-mbstring_5.3.29-209_arm64.deb
    sha:959a34f1fe3ab1f25568b53801dd6705769867a9
  • alt-php53-mcrypt_5.3.29-209_arm64.deb
    sha:3eeca3b73ccdebd122c74f3de20bdc0dc3a921a2
  • alt-php53-mssql_5.3.29-209_arm64.deb
    sha:b9fb0876b6de47d8ab07bcdb3be6ab2fc621f58a
  • alt-php53-mysqlnd_5.3.29-209_arm64.deb
    sha:0ad4693662e08ecc231cef05cdfe14208aa39a39
  • alt-php53-odbc_5.3.29-209_arm64.deb
    sha:7ef31f8fa36d8456aad2eb7fa1b2f00981cf3b9d
  • alt-php53-pdo_5.3.29-209_arm64.deb
    sha:f55c5eca56cbdf73d5e6f8b073713efc23577c85
  • alt-php53-pgsql_5.3.29-209_arm64.deb
    sha:e91f2e9a6c1e865c50f3a1dd1768f43e7f6cb654
  • alt-php53-php-fpm_5.3.29-209_arm64.deb
    sha:b817546632c1f867079b6d5fbddd3207c7538de8
  • alt-php53-process_5.3.29-209_arm64.deb
    sha:39770c1551634a93584611e04e7a498ae2fcfc7e
  • alt-php53-pspell_5.3.29-209_arm64.deb
    sha:097b15c05853bb0f86c7aca3760bba304fbdf376
  • alt-php53-recode_5.3.29-209_arm64.deb
    sha:8575feae9db44343d37f59555e7aa3c19fa5defc
  • alt-php53-snmp_5.3.29-209_arm64.deb
    sha:fab57e587bc92bc1a90440a99e8df87a0a7387e8
  • alt-php53-soap_5.3.29-209_arm64.deb
    sha:5f9a073357fdb10e7d2b259c83bf2ff54c598bdf
  • alt-php53-sybase_5.3.29-209_arm64.deb
    sha:aeb2daa6400c2dcb7d18488e780acb93c68e921a
  • alt-php53-tidy_5.3.29-209_arm64.deb
    sha:ec9540f698f7bffbfa98f7973f81c08df49c0501
  • alt-php53-xml_5.3.29-209_arm64.deb
    sha:1f50116c70875f3484bcd405235cf24e30ad8869
  • alt-php53-xmlrpc_5.3.29-209_arm64.deb
    sha:82617a8048c208c305e734894a286588a9e1c89e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.