[CLSA-2026:1786357016] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-10 10:17:08 UTC
Description:
* CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an end-of-stream code * CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-74_amd64.deb
    sha:4ecb708eb316889968665fc03682c41d6fa482a9
  • alt-php73-bcmath_7.3.33-74_amd64.deb
    sha:b35d5f408c4af0c0f024a819994d95a3bbd45144
  • alt-php73-cli_7.3.33-74_amd64.deb
    sha:51c2b0ed9cd17a2dcbead212eae41897b010237f
  • alt-php73-common_7.3.33-74_amd64.deb
    sha:8fce985c94186fb1026edc63a4514d2ac29038e5
  • alt-php73-dba_7.3.33-74_amd64.deb
    sha:e789b963ea8dbe2cb6aa065bf180c2e505c0a3c5
  • alt-php73-dev_7.3.33-74_amd64.deb
    sha:3e9e2094b7361e06660d6903a339ba8c66e2c0ac
  • alt-php73-enchant_7.3.33-74_amd64.deb
    sha:cc2ea2c0c8dba35d34dbdb6e7fe472a1412fb69c
  • alt-php73-firebird_7.3.33-74_amd64.deb
    sha:46dc5c6d1fe009f7664d3db59fde0b2ae3ff0b76
  • alt-php73-gd_7.3.33-74_amd64.deb
    sha:8ee5b670ff7e0b8a1d84d86d514e5e07e659d56a
  • alt-php73-imap_7.3.33-74_amd64.deb
    sha:ad33bb179f65356f034f982694f55e6f01fbd6b4
  • alt-php73-intl_7.3.33-74_amd64.deb
    sha:9be0ceba59fb02e964497c5e76e51f9e1a10c66b
  • alt-php73-ldap_7.3.33-74_amd64.deb
    sha:e9be7678e33e88e419028185175883e19705f6a1
  • alt-php73-mbstring_7.3.33-74_amd64.deb
    sha:6b4b8867f0a1b42be3518864777b234ae5e3a2a8
  • alt-php73-mysqlnd_7.3.33-74_amd64.deb
    sha:bd11901c6d9fb609c2f84bdeb6bbeb5d4932f24a
  • alt-php73-odbc_7.3.33-74_amd64.deb
    sha:d0ab3ecc6cae87411db5d2b57fc9d12340446ced
  • alt-php73-opcache_7.3.33-74_amd64.deb
    sha:d773c24f59c9130c410c1fbf77eb39a173f5dcbc
  • alt-php73-pdo_7.3.33-74_amd64.deb
    sha:b553505e4f3652e63557e32bbc6656dfaf9decd9
  • alt-php73-pgsql_7.3.33-74_amd64.deb
    sha:4119a7d50a2345f56e271478e06183e2d811ea96
  • alt-php73-php-fpm_7.3.33-74_amd64.deb
    sha:e975e848c50e2fc3568c7992ba3b50e11841b1e8
  • alt-php73-process_7.3.33-74_amd64.deb
    sha:91ad0cfde1bf0f1b1b3f24431a7944b58a49ad94
  • alt-php73-pspell_7.3.33-74_amd64.deb
    sha:689487ab7e56fd07715a3881f977ed0e56821827
  • alt-php73-recode_7.3.33-74_amd64.deb
    sha:ce405c0407b18288e5cea2093c4bdece7f0d7097
  • alt-php73-snmp_7.3.33-74_amd64.deb
    sha:0892a6330ba6bf9237475f6f63037e96e0560b9c
  • alt-php73-soap_7.3.33-74_amd64.deb
    sha:54932585db51738d777bc78c42fca5c857abbf53
  • alt-php73-sodium_7.3.33-74_amd64.deb
    sha:1c995c7356d1a0a0854c79ae608811a429ae906f
  • alt-php73-tidy_7.3.33-74_amd64.deb
    sha:8013d184c2a5c598c72934e5fba59a8ce8bbfec9
  • alt-php73-xml_7.3.33-74_amd64.deb
    sha:26cce0615098662a8517057dbf8a4ed8f1ca2c99
  • alt-php73-xmlrpc_7.3.33-74_amd64.deb
    sha:5414fea910f3aacbec77acd7f6dc35a9a6976260
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.