[CLSA-2026:1786448352] php: Fix of 3 CVEs
Type:
security
Severity:
Critical
Release date:
2026-08-12 10:55:33 UTC
Description:
- CVE-2026-7260: fix stack exhaustion on circular symlinks in tar-based phar archives; also backport upstream bug #69720 (NULL pointer dereference in phar_get_fp_offset()), without which the fix only relocates the crash - CVE-2026-17543: fix SQL injection in ext/pgsql via backslash breakout from E'...' literals - CVE-2026-9672: fix bundled libgd GIF decoder LZW table reset, end-code handling and uninitialised state
CVEs fixed:
Updated packages:
  • php-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:c907dfd07ee89f2159b6a12b85c54b6f0f18d24daece2e451cb3345e12f5781b
  • php-bcmath-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:969bd65612e82862b3b9851212f63fe6daf857cc7f205adffcdd4d37436b6fa4
  • php-cli-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:7cfb860f6765bbcc55ae502598795726902f5341ae5602369886e7f9d4bf7d14
  • php-common-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:f69cf4d4ac53d1e00149241fdfed0c1ae653ffb69f72fcc7439cb596972aed67
  • php-dba-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:378ab4430f98cf779c958312708cb64304b21fb75500353d1f7a2b5ff0cae878
  • php-devel-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:bcc9bb24a8423194e6f2f697ea556cda1b25519f102919331773219cf705a5c1
  • php-embedded-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:22ff93fe358de9e9ec314d636eba9fccc3876e4a571413ea242efc6e58d464ba
  • php-enchant-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:73dcf47baa596793ad664848c67189d927a6b923ff7ff87bbc2233d9c81818d1
  • php-fpm-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:601f1cb050b4d98ce31f85bf1368e339a0646be861c81c373cd9de2d0e862322
  • php-gd-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:012834b3f0414bb7b8f0fd8359e5d1f6bdface864abb99228847aee1c0a0fade
  • php-intl-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:c993d166c3912734fc5c854cd467ab65d0ee6f3020f0ec98b04f1f7ab5309943
  • php-ldap-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:10589807d45521b039ff42d4fdae3e009a77b6022004c65bc5f3ada27c9a6141
  • php-mbstring-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:b9c1c24c66679ad5943dac4c8a0206c4d8b186fd7a86a59d70fccd9e566fafe1
  • php-mysql-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:3524b8b5e1e1cfbf290350f6f86a402712cec04d503c73fc75da1f9bc2c5e9ee
  • php-mysqlnd-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:274c36528bd49249722fb3ff0d88d21fdb0e8ecb0aa301fba41421e70f848180
  • php-odbc-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:d99e713de19c4eff5e042d5999f1f90f7ac38aac2de0de9838a4d83bc6eb521f
  • php-pdo-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:b6b2db797484ea022eb32e3ba81174868aa2ab16619c4978f28b74e31ee5cee7
  • php-pgsql-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:293cb985fb98617a62d2b08f6bc396c35fab4411205e08447a4180f4a1ef3c95
  • php-process-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:9a1f256ea9ad176fa747db49929b2d9aefd24627b81088674cd0dc44f3d36fe9
  • php-pspell-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:5a679a2cefe95149e352f6ec4f42817c3bc175a2f7ea6aa41c3c912e6f2add64
  • php-recode-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:dc36c145de2d53c72d13f2a6f3cf5de406ca177f89429cf4574f6a7e11189ce8
  • php-snmp-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:260e0bdc25286ccd6bc7f0dc95e1568b5ffb33d51bd841ed07f3d07ec2466aba
  • php-soap-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:4d55791a09640bc677305b1335a6a89e42db65890fa89c57c159c1916129176d
  • php-xml-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:86bc6ff5b7651f27692e2fb385920df209ad16eec72c267a34de5ce28c289a6b
  • php-xmlrpc-5.4.16-48.el7.tuxcare.els19.x86_64.rpm
    sha:3b4a04c38fe7baf5f1755c0950bf2cfe4514cce12586d4c509d9c9a0919938fc
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.