[CLSA-2026:1786383676] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-10 17:42:02 UTC
Description:
* CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped values escaped by PQescapeStringConn() in an E'...' escape-string constant, but that escaper leaves backslashes untouched when standard_conforming_strings is on, so a trailing backslash escaped the doubling quote and broke out of the literal. Drop the E prefix so the plain '...' form matches what the escaper produces. * CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed symlink chains by tail recursion with no cycle or depth guard, so a tar phar holding circular links exhausted the C stack. Walk the chain iteratively with Floyd cycle detection and return NULL on a loop; also restore the '/' separator in phar_get_link_location() so the walk stays idempotent.
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-29_amd64.deb
    sha:3d0c0666e445ab35ca22d5bfaba5a982601a0eed
  • alt-php81-bcmath_8.1.34-29_amd64.deb
    sha:b9b750cb8845638397ba78a7a9a8d926fbefb6c8
  • alt-php81-cli_8.1.34-29_amd64.deb
    sha:179053995189db1f538b1c1291526efe4a752f4e
  • alt-php81-common_8.1.34-29_amd64.deb
    sha:1f6beab8843666b4695135c13d714b5bae19f429
  • alt-php81-dba_8.1.34-29_amd64.deb
    sha:1ff513a23370a04126a67e6d1a62f74fa2b87b08
  • alt-php81-dev_8.1.34-29_amd64.deb
    sha:1ca259f80aa580ce5a952253ef61e451bbfe5815
  • alt-php81-enchant_8.1.34-29_amd64.deb
    sha:ecc36f64b71bd7f18d46c80be5bddffcfc4fe4d9
  • alt-php81-firebird_8.1.34-29_amd64.deb
    sha:89f9a510c5811d94ad26e7ed7c0978a1af3dfc4b
  • alt-php81-gd_8.1.34-29_amd64.deb
    sha:2fed88a6ea24f667f3e831030192f61525a52679
  • alt-php81-imap_8.1.34-29_amd64.deb
    sha:b61320d0376d36bea84c7cea8d62b847b1900f35
  • alt-php81-intl_8.1.34-29_amd64.deb
    sha:4b8d0a4a095b1bfc30969232fde3f9002a7c1aed
  • alt-php81-ldap_8.1.34-29_amd64.deb
    sha:40fcb29df2bfb575803fc601bb4992b368015344
  • alt-php81-mbstring_8.1.34-29_amd64.deb
    sha:8ed5dfedcd6ac88d5e21865143038e1670528745
  • alt-php81-mysqlnd_8.1.34-29_amd64.deb
    sha:86cf49731a58c1cbc7466daf8c6cd325ee175dd5
  • alt-php81-odbc_8.1.34-29_amd64.deb
    sha:6c1af296a3103cd742621c10b8d63a50240f7b5a
  • alt-php81-opcache_8.1.34-29_amd64.deb
    sha:ba849ba18561138b1576390d318cc125d95f0aa8
  • alt-php81-pdo_8.1.34-29_amd64.deb
    sha:a1177343b6b3e2b8c5a2848d9a78f05aa0d0e4e7
  • alt-php81-pgsql_8.1.34-29_amd64.deb
    sha:865e379a73ff9320ebf6b93d14f9eb4f2fa0ef6d
  • alt-php81-php-fpm_8.1.34-29_amd64.deb
    sha:7ce35d9fb1ca191aeff8e5c9f9675fd70715eda7
  • alt-php81-process_8.1.34-29_amd64.deb
    sha:4c4f8d79f09498e9ef553024b72f0d76c4bbd8f6
  • alt-php81-pspell_8.1.34-29_amd64.deb
    sha:e507243090d0a81bebc0790bdc7c4a34e6e8ed90
  • alt-php81-snmp_8.1.34-29_amd64.deb
    sha:91ffcbab3ba2c6aa210934b818496332010d1838
  • alt-php81-soap_8.1.34-29_amd64.deb
    sha:8e87d6526d90551555e5416c69901c3d92ed9ad6
  • alt-php81-sodium_8.1.34-29_amd64.deb
    sha:d91d2637cbe0647b5ef0136cd458c74e81db4402
  • alt-php81-tidy_8.1.34-29_amd64.deb
    sha:caa7996e13a4232f192953b1ee9f497f1f97527c
  • alt-php81-xml_8.1.34-29_amd64.deb
    sha:084e4fa83bc19ce6bc222ea018e4213f1543a015
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.