[CLSA-2026:1786521605] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-12 08:00:18 UTC
Description:
* CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php74_7.4.33-70_amd64.deb
    sha:57c9ce3d0701d8c57c11cb26ae567736ee7f36f6
  • alt-php74-bcmath_7.4.33-70_amd64.deb
    sha:bf6eeccd13a12dcc163ed7cdff379137e8413800
  • alt-php74-cli_7.4.33-70_amd64.deb
    sha:29cb4b60778da9c94e3cdacd9d4f3ddca26ede8e
  • alt-php74-common_7.4.33-70_amd64.deb
    sha:0bd0db9e0ba9597cac1144ef1ebf08a5ec361233
  • alt-php74-dba_7.4.33-70_amd64.deb
    sha:258b7f8258c2cd05f8131ec634a61fba961babc2
  • alt-php74-dev_7.4.33-70_amd64.deb
    sha:21d0a0a7e705e0b0bbc259c1cddc2c9eb5c500c9
  • alt-php74-enchant_7.4.33-70_amd64.deb
    sha:f3765bce8d76fd124d4a52b411548e8917a1cd7f
  • alt-php74-firebird_7.4.33-70_amd64.deb
    sha:56a6b93f37c586f015392533d81024c3584c1dac
  • alt-php74-gd_7.4.33-70_amd64.deb
    sha:ca25f40eeba89843b64a98cb75d5f500ab75a217
  • alt-php74-imap_7.4.33-70_amd64.deb
    sha:f2333c0e8e7f551a0a7c011bd1150b751f621266
  • alt-php74-intl_7.4.33-70_amd64.deb
    sha:9dda5df2a921202abc44a2a510d999905d85ab7b
  • alt-php74-ldap_7.4.33-70_amd64.deb
    sha:7e9ccfd3b15a1465f52bcc77cf5401584aad1973
  • alt-php74-mbstring_7.4.33-70_amd64.deb
    sha:905e2e17962a1830e3368f412c277c7eb57919e3
  • alt-php74-mysqlnd_7.4.33-70_amd64.deb
    sha:25840d93d1a2ebe9893b2a448cd45bca8c67ba93
  • alt-php74-odbc_7.4.33-70_amd64.deb
    sha:8220a1b10f3de7d1ce5879f2d5fc6c65ce86f30d
  • alt-php74-opcache_7.4.33-70_amd64.deb
    sha:077e60577830b14918befa1427810f73bbb35930
  • alt-php74-pdo_7.4.33-70_amd64.deb
    sha:dd55b97d3699a5d6919a492db8c76b4802a26386
  • alt-php74-pgsql_7.4.33-70_amd64.deb
    sha:f40b161fa19077be36334a829b634d0e0f75f2d4
  • alt-php74-php-fpm_7.4.33-70_amd64.deb
    sha:ff555dce218b8fd3bd14d28e27edfef5554369c6
  • alt-php74-process_7.4.33-70_amd64.deb
    sha:bda56b62e3f7ecd642162e716d76df6e5b80779b
  • alt-php74-pspell_7.4.33-70_amd64.deb
    sha:69b5e3373016207d376c5492cfb8a841734b6efc
  • alt-php74-snmp_7.4.33-70_amd64.deb
    sha:08cba4a89752ddd0407503974f78a4815099976b
  • alt-php74-soap_7.4.33-70_amd64.deb
    sha:4c68a701fedea60f530e3396710a06c3792d6151
  • alt-php74-sodium_7.4.33-70_amd64.deb
    sha:2a197a56d3071620d5b496881682b057b8d35435
  • alt-php74-tidy_7.4.33-70_amd64.deb
    sha:00a25f10ed84ae95ffe5776694a95d1fe1a88bb8
  • alt-php74-xml_7.4.33-70_amd64.deb
    sha:0716e4504024a5cea06a8943c29209a637863f52
  • alt-php74-xmlrpc_7.4.33-70_amd64.deb
    sha:3bbb6733fc6d3b25cb572ec9c118050fb5d2d6f9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.