[CLSA-2026:1786355965] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-10 09:59:37 UTC
Description:
* CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped values escaped by PQescapeStringConn() in an E'...' escape-string constant, but that escaper leaves backslashes untouched when standard_conforming_strings is on, so a trailing backslash escaped the doubling quote and broke out of the literal. Drop the E prefix so the plain '...' form matches what the escaper produces. * CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed symlink chains by tail recursion with no cycle or depth guard, so a tar phar holding circular links exhausted the C stack. Walk the chain iteratively with Floyd cycle detection and return NULL on a loop; also restore the '/' separator in phar_get_link_location() so the walk stays idempotent.
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-29_amd64.deb
    sha:407cf7df5ff5f674ea0b4abd23c1c883ee20f7bf
  • alt-php81-bcmath_8.1.34-29_amd64.deb
    sha:3be5bdebe5dcad2ff3426f0e126ec2ad2f6b59db
  • alt-php81-cli_8.1.34-29_amd64.deb
    sha:f3449b3ba87e3c974c05df3268216c0931a5a7b6
  • alt-php81-common_8.1.34-29_amd64.deb
    sha:81f8ac38dea3ff8a1f9901ad3ff6a28237e65645
  • alt-php81-dba_8.1.34-29_amd64.deb
    sha:5655e17a8e8da9a74d2164a31fe3df9e82a59c36
  • alt-php81-dev_8.1.34-29_amd64.deb
    sha:544a46ab35f2b5cd2522f2024af46dd3a93eb023
  • alt-php81-enchant_8.1.34-29_amd64.deb
    sha:acfee45c4714eefbf0b60a84734929459333e829
  • alt-php81-firebird_8.1.34-29_amd64.deb
    sha:164dcb446fbe076cbafd3563d71ec3799a4fad22
  • alt-php81-gd_8.1.34-29_amd64.deb
    sha:05beed6fc501a6f0e0888ad4d1e088065e2eb725
  • alt-php81-imap_8.1.34-29_amd64.deb
    sha:26a4d2b3d1cfb9e9e21273bf8aae0a51c858fc67
  • alt-php81-intl_8.1.34-29_amd64.deb
    sha:f435f4a049e7dc9eff8ac88399ce9c23fb30c26e
  • alt-php81-ldap_8.1.34-29_amd64.deb
    sha:373bafccf6d0059829b654890533b4c82f6cc0e2
  • alt-php81-mbstring_8.1.34-29_amd64.deb
    sha:00c81e6498333e6e0a6ac10325ad236a4bfaac79
  • alt-php81-mysqlnd_8.1.34-29_amd64.deb
    sha:17d498e3cf3b59b9f74ebfe92019e37d8b2331ca
  • alt-php81-odbc_8.1.34-29_amd64.deb
    sha:46ccd997a9d0444d2deb2d7daeea68ea022c8893
  • alt-php81-opcache_8.1.34-29_amd64.deb
    sha:99acf5ac0c5dd0506e9dc80311a2dfbd935cfc29
  • alt-php81-pdo_8.1.34-29_amd64.deb
    sha:74fbacafb9b4fb857ef973052df8d28b0d875930
  • alt-php81-pgsql_8.1.34-29_amd64.deb
    sha:3b6ecb9eff7706602cc67e155cda5073ed466246
  • alt-php81-php-fpm_8.1.34-29_amd64.deb
    sha:4bd96d3734c2ea0881ee425788002911eac27c4d
  • alt-php81-process_8.1.34-29_amd64.deb
    sha:eefb57a505622cf53e3d2886b9add854d73a1fba
  • alt-php81-pspell_8.1.34-29_amd64.deb
    sha:7c718d42ba97d02825a7caab47230f3c395c888d
  • alt-php81-snmp_8.1.34-29_amd64.deb
    sha:199fb0becc8b977a9635f456fcc859acfe705f18
  • alt-php81-soap_8.1.34-29_amd64.deb
    sha:c97bdcf32fef1abd1f9850ee2164862e0f73683a
  • alt-php81-sodium_8.1.34-29_amd64.deb
    sha:e00a144852a0a7ea9e201ba2223fd19de83af461
  • alt-php81-tidy_8.1.34-29_amd64.deb
    sha:b64c2d62b6e72fdd6288d9be090a3aeb197b9b23
  • alt-php81-xml_8.1.34-29_amd64.deb
    sha:943e124eb1e049d0e8b8be177fc2b756cead8696
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.