Release date:
2026-08-03 12:12:48 UTC
Description:
- CVE-2026-7260: uncontrolled recursion in phar_get_link_source(); a tar-based
phar archive holding circular symlinks exhausts the C stack and crashes the
PHP process
- CVE-2026-7260: NULL pointer dereference in phar_get_fp_offset() reached from
phar_get_entry_data() once phar_get_link_source() reports a circular chain;
the phar:// stream read path had no guard (upstream bug #69720)
- phar_get_link_location() permanently truncated entry->filename at the last
'/', so a symlink chain walked with two cursors resolved later hops against
the wrong directory; the separator is now restored
- CVE-2026-9672: use of uninitialized memory in the bundled libgd GIF decoder;
LWZReadByte_() left most of the LZW code table uninitialized and kept
decoding after the end code
Updated packages:
-
php-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:8fb53f1e9a06ebd5ca70538f0003d32fe98438661796ffe9b02376e6a8810e79
-
php-bcmath-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:8a58bb463618ac0fabfa1a0ac3a5a3373c93f5151e4c637db64271fa7f2a7027
-
php-cli-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:71d8b695ca55d50f7314b33f4654a2a66ed274cbf25dbd5bf638050b99a7f8cb
-
php-common-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:68d73164fa7660181d865d83f3f8d41e2a6b9d515844aee8e4e3daa282087308
-
php-dba-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:7dd69515c0c09325a8c3b87b8b58be01bf0644f3d85c4158d04ad4a8863481da
-
php-devel-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:d2483b3cc2a36e5c01380e77c35cc6213ecde5c80842a778c5157f49c984ba2b
-
php-embedded-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:f485d70dee13fa5c48e8382823462ffbcb812d8c77df9b5e3eda48b8cb2baf58
-
php-enchant-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:52d00cd40a6b7346f4d4853f42f49d5eb7b17ffe7146a4b8ee5c0127b21fed87
-
php-fpm-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:25b31af6f859a117148553e4667c606824c74cd4b029ac8fec379af057e8817f
-
php-gd-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:bce9689715e8e486ed9501061839900553540aa2b5056ca2c337814298bc9f90
-
php-intl-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:e45bd0528fc39fe4abfd3d5b4cd98ba42319ad138257ebe94cb4cef3219ab694
-
php-ldap-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:a8f1f3abfbe89064de99187a52a61be5054d9a47455f96963e04a33736b7da7b
-
php-mbstring-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:a992937bd9d1f0ed8d2979ad05937aa35ec4f8b1b8e93e20a7343a132debff07
-
php-mysqlnd-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:edf2b77938d23f9756c40dbca75fc11b816b048b426503bb3a26fb448a839182
-
php-odbc-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:4ef6b412a5ee9ad42130476d3f72c690909e177b347ba3758120bcf60b63aae6
-
php-pdo-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:8470987806c4c4b7468d93711be01ddc304fafe767f1b636199cfee0b2a9a34b
-
php-pgsql-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:08015c3431f9318d7222ce7c7edd89111e1ed7fe1e1dd1e2bbff7a930fd25405
-
php-process-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:9461479274376ea5ad460b7fae89018f97353048e33548a2161efb12039e845d
-
php-pspell-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:f3963c0cac0f75508651ae12c82b15c8b0f0d271ddf933dbe773122b12a955af
-
php-recode-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:4badb02a8f7505370529aca768ce548f03cff665796b45b1eb01e4000516d4bb
-
php-snmp-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:95623b25dab1ab353ca883e479ccf488a7ad04f40549f7a86f04640868dac436
-
php-soap-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:cb522df8d0b37e9ce422c733248a9433887cccfce8b619591a30169a0fc8a7ec
-
php-xml-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:fcd97b6a33aaebd87c5671bf959e182ca9127664d197b2e8d84e508a0d021d95
-
php-xmlrpc-5.4.16-46.amzn2.0.7.tuxcare.els3.x86_64.rpm
sha:f9b80fe03ff983f599df8ad256e7b2c40f45f00eb2fc4f89a59d30590cd3f144
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
