[CLSA-2026:1786382972] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-10 17:29:52 UTC
Description:
* CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped values escaped by PQescapeStringConn() in an E'...' escape-string constant, but that escaper leaves backslashes untouched when standard_conforming_strings is on, so a trailing backslash escaped the doubling quote and broke out of the literal. Drop the E prefix so the plain '...' form matches what the escaper produces. * CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed symlink chains by tail recursion with no cycle or depth guard, so a tar phar holding circular links exhausted the C stack. Walk the chain iteratively with Floyd cycle detection and return NULL on a loop; also restore the '/' separator in phar_get_link_location() so the walk stays idempotent.
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-29_amd64.deb
    sha:407cf7df5ff5f674ea0b4abd23c1c883ee20f7bf
  • alt-php81-bcmath_8.1.34-29_amd64.deb
    sha:6b15e0762992e38f8735a775988520c5ede1da7b
  • alt-php81-cli_8.1.34-29_amd64.deb
    sha:f1370e8735d26546c709630e8eb00a76412efb91
  • alt-php81-common_8.1.34-29_amd64.deb
    sha:9346374adf81ad335be90c5e6b596ce86af62c3d
  • alt-php81-dba_8.1.34-29_amd64.deb
    sha:91f6016198020c9294f353e74f8c5e1326fd57ba
  • alt-php81-dev_8.1.34-29_amd64.deb
    sha:1b8d302d1ca0ec94f7a238f3e1935070c8dd620a
  • alt-php81-enchant_8.1.34-29_amd64.deb
    sha:f5aabf678a81b91ff7592b56528c5c2158a1da4c
  • alt-php81-firebird_8.1.34-29_amd64.deb
    sha:ae43ac0492be1a8132966cf7ba4f2556ab25db38
  • alt-php81-gd_8.1.34-29_amd64.deb
    sha:414f17347cab4ff36824c4ea3414cd5edc9753a8
  • alt-php81-imap_8.1.34-29_amd64.deb
    sha:7fbe869a44287941fc9495433776a5ebd5aebf7f
  • alt-php81-intl_8.1.34-29_amd64.deb
    sha:a008e9948356b1c7dd63983a4631bf451e5ff8ab
  • alt-php81-ldap_8.1.34-29_amd64.deb
    sha:9b45d3b066a8e59d81f1b28ada95e426769d9047
  • alt-php81-mbstring_8.1.34-29_amd64.deb
    sha:e329d12a28a582ca7bd16a35e13ae8394a1b2144
  • alt-php81-mysqlnd_8.1.34-29_amd64.deb
    sha:f9d7b6ea9b94ce6d6f3cff9a73c9e6b6e894e342
  • alt-php81-odbc_8.1.34-29_amd64.deb
    sha:531677f82e33eb64782487192e874cfbc72db84b
  • alt-php81-opcache_8.1.34-29_amd64.deb
    sha:80a4f7a48b58218ab93673e81f4b6ca85745d129
  • alt-php81-pdo_8.1.34-29_amd64.deb
    sha:4f292b6296eb9ceb618e5fa990e01449dca4cd8c
  • alt-php81-pgsql_8.1.34-29_amd64.deb
    sha:6e8ff74c4c63b7672bc2dcda9bef50566bc17de2
  • alt-php81-php-fpm_8.1.34-29_amd64.deb
    sha:8cc3cd7d8f4c0f12811bcfda36f501a7dbb9ced4
  • alt-php81-process_8.1.34-29_amd64.deb
    sha:1bab0b55c3f6112a334d67d7e0f05d9a5a60ace1
  • alt-php81-pspell_8.1.34-29_amd64.deb
    sha:c2c8ae359e9bbda817d8cc6a01bb4a27193750a0
  • alt-php81-snmp_8.1.34-29_amd64.deb
    sha:2deca1c342df7086e962f8945df3f0bec9535bbd
  • alt-php81-soap_8.1.34-29_amd64.deb
    sha:325f252d65ea97b73a3d773ba617a65ccb50c29c
  • alt-php81-sodium_8.1.34-29_amd64.deb
    sha:15e02c401c2f682c89ff22ef44d997ad9477c3cf
  • alt-php81-tidy_8.1.34-29_amd64.deb
    sha:8b0a4ad9c3262d90862453e0eaae4bb2a71de0e4
  • alt-php81-xml_8.1.34-29_amd64.deb
    sha:532466539a8e93e8b7bc20c1c2e0ab88e3529d51
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.