[CLSA-2026:1786361041] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-10 11:24:14 UTC
Description:
* CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an end-of-stream code * CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-74_amd64.deb
    sha:4138a6dca296ebcade9fea6011851c3e132c5b88
  • alt-php73-bcmath_7.3.33-74_amd64.deb
    sha:0166f97a2d89b0df55fc083c502dc4eac7085cb5
  • alt-php73-cli_7.3.33-74_amd64.deb
    sha:0069c9bac8b2ad81f1a0a49106088b0c38baf651
  • alt-php73-common_7.3.33-74_amd64.deb
    sha:28ca555c717a6bfa15c64c6203b7e3c40e03c99b
  • alt-php73-dba_7.3.33-74_amd64.deb
    sha:9df57b53781946035b3cab41d6b86122e3e88e27
  • alt-php73-dev_7.3.33-74_amd64.deb
    sha:89c8258138b50650d156f233a5a9f219dbd1c257
  • alt-php73-enchant_7.3.33-74_amd64.deb
    sha:7167b8dd4820d5c5cbb975edf05630a5011e4f54
  • alt-php73-firebird_7.3.33-74_amd64.deb
    sha:6aa2b8b8e120e23f1fcacfb0e80d21d238df2b47
  • alt-php73-gd_7.3.33-74_amd64.deb
    sha:347a6b0cee240e68d8f716346acc5bb60c8c6247
  • alt-php73-imap_7.3.33-74_amd64.deb
    sha:ad61ac7cdd984ee49dd27cb090d92c39f4643014
  • alt-php73-intl_7.3.33-74_amd64.deb
    sha:2b5422b509863320e687c9d796ac47d1da234222
  • alt-php73-ldap_7.3.33-74_amd64.deb
    sha:e2c4737b72458c3792a4fa70342aefa1e629d9bc
  • alt-php73-mbstring_7.3.33-74_amd64.deb
    sha:4ef01e427b60f8511b576378cd292db2cc5116f5
  • alt-php73-mysqlnd_7.3.33-74_amd64.deb
    sha:839ce4a53b0c0f2260aaa43a305fb61fe0daf304
  • alt-php73-odbc_7.3.33-74_amd64.deb
    sha:89097e1945fa22015d769502d0ba61815c5502ee
  • alt-php73-opcache_7.3.33-74_amd64.deb
    sha:2f037a9d0b88197bc4f25413c659252b079db6b6
  • alt-php73-pdo_7.3.33-74_amd64.deb
    sha:7628583027f76fe88887cc2965ff08b982235bda
  • alt-php73-pgsql_7.3.33-74_amd64.deb
    sha:14f1911db78a3fdd84a93d1bca2137426058986e
  • alt-php73-php-fpm_7.3.33-74_amd64.deb
    sha:7213416cb0fa2aa009139eb74d0d268b33740a3d
  • alt-php73-process_7.3.33-74_amd64.deb
    sha:2fdacd9e1e0971192e7eaadfa9cc9a8fd8c47e9c
  • alt-php73-pspell_7.3.33-74_amd64.deb
    sha:f9eb315e30f8faf39937981b1796d74fa3c4e558
  • alt-php73-recode_7.3.33-74_amd64.deb
    sha:a22edd29ef86e02cce2c6f5c4e5a0d25b84b720c
  • alt-php73-snmp_7.3.33-74_amd64.deb
    sha:a6e56a0c236a1b1687377fbe2cd389a27c98e772
  • alt-php73-soap_7.3.33-74_amd64.deb
    sha:b6600e2fbc947cf15c84186380a18339552074d6
  • alt-php73-sodium_7.3.33-74_amd64.deb
    sha:0645066e0f5523cd4aed0908c12a5ac255b345b5
  • alt-php73-tidy_7.3.33-74_amd64.deb
    sha:ea2c5c483a39284ccbb168dd1eb55b4f8cacdbcc
  • alt-php73-xml_7.3.33-74_amd64.deb
    sha:63fae355371434c58c92b15a8bfa12fde3208942
  • alt-php73-xmlrpc_7.3.33-74_amd64.deb
    sha:2e64bc0c89feb049d208642f443726f237cad7e0
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.