[CLSA-2026:1786382230] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-10 17:17:35 UTC
Description:
* CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped values escaped by PQescapeStringConn() in an E'...' escape-string constant, but that escaper leaves backslashes untouched when standard_conforming_strings is on, so a trailing backslash escaped the doubling quote and broke out of the literal. Drop the E prefix so the plain '...' form matches what the escaper produces. * CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed symlink chains by tail recursion with no cycle or depth guard, so a tar phar holding circular links exhausted the C stack. Walk the chain iteratively with Floyd cycle detection and return NULL on a loop; also restore the '/' separator in phar_get_link_location() so the walk stays idempotent.
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-29_amd64.deb
    sha:5954c8804fe098936bfb839b2766736ff95113e9
  • alt-php81-bcmath_8.1.34-29_amd64.deb
    sha:f3fe8c10d202d1c55ce6f1a7945e788ef79e1277
  • alt-php81-cli_8.1.34-29_amd64.deb
    sha:599ade44c539efcdf25ec038cfb3205790c3048b
  • alt-php81-common_8.1.34-29_amd64.deb
    sha:abeb712c3ba521c9eb46824521881e604de1236b
  • alt-php81-dba_8.1.34-29_amd64.deb
    sha:584c5facd09dfc83c7ae5922bb181fa0b15dd3a6
  • alt-php81-dev_8.1.34-29_amd64.deb
    sha:ae007e9a0c129fee0acd634f29bdea408f241a59
  • alt-php81-enchant_8.1.34-29_amd64.deb
    sha:6df737d838b0ea5a317c1a0f642dedc3aee13c67
  • alt-php81-firebird_8.1.34-29_amd64.deb
    sha:4240b024758ac0393e133500ddf5bf887263b1c9
  • alt-php81-gd_8.1.34-29_amd64.deb
    sha:e38b051985d60e971915339d92f1bf9e0fc07b07
  • alt-php81-imap_8.1.34-29_amd64.deb
    sha:adf695a352d0799da1631035ace64be341894fa7
  • alt-php81-intl_8.1.34-29_amd64.deb
    sha:7d81b41bd83745235af2511d6f2c7497c73c8c5b
  • alt-php81-ldap_8.1.34-29_amd64.deb
    sha:5c86a574cfbc2995dd9119980f5f768da8d87bc3
  • alt-php81-mbstring_8.1.34-29_amd64.deb
    sha:00ae9b504bb40d96b93888e809e397ba7c3a21bf
  • alt-php81-mysqlnd_8.1.34-29_amd64.deb
    sha:c593cd07648681dbfc2344a123643d44153e0fe8
  • alt-php81-odbc_8.1.34-29_amd64.deb
    sha:29dec60273695304b0eeebf12cfbd1de98736cfb
  • alt-php81-opcache_8.1.34-29_amd64.deb
    sha:0a856251b6f141aa3e40252fe2fc39390269402b
  • alt-php81-pdo_8.1.34-29_amd64.deb
    sha:89c5a2cd3bfff6006255daf31d34aaa72138529d
  • alt-php81-pgsql_8.1.34-29_amd64.deb
    sha:70d5e03bdfdf053eb23c504b1598c52d8e5d2545
  • alt-php81-php-fpm_8.1.34-29_amd64.deb
    sha:5ee6a3c0c545ff5a6168d36276ddf7df92f7d363
  • alt-php81-process_8.1.34-29_amd64.deb
    sha:77d91274d78e91fda0d54a3413dd252a37fd4c53
  • alt-php81-pspell_8.1.34-29_amd64.deb
    sha:3dddfad964e88d3fb6fc25c0a6c3ab18066fbe0f
  • alt-php81-snmp_8.1.34-29_amd64.deb
    sha:f06f4dd3c82613873d1bba19d915abde98a37440
  • alt-php81-soap_8.1.34-29_amd64.deb
    sha:ddfd828fe781423138ad731b7f2dc6092279dc30
  • alt-php81-sodium_8.1.34-29_amd64.deb
    sha:03abae7ba871774c84a12868cb7a20c81fed2991
  • alt-php81-tidy_8.1.34-29_amd64.deb
    sha:ec5cc64cb1518bcde59927fa2395d179931e8ec9
  • alt-php81-xml_8.1.34-29_amd64.deb
    sha:f83f22e3748d9a2cb0e0c18d017b9dc28c87f8e5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.