[CLSA-2026:1786587104] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-13 02:11:56 UTC
Description:
* CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an end-of-stream code * CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-74_amd64.deb
    sha:5747d90458c39726d242919a0094f829de0ae56b
  • alt-php73-bcmath_7.3.33-74_amd64.deb
    sha:ffbe4e5c3dcfcb0ab612bf698b5905a2fa129574
  • alt-php73-cli_7.3.33-74_amd64.deb
    sha:568fdee668dc6f42ff27c6a6b6a79b3d1d8fa2c8
  • alt-php73-common_7.3.33-74_amd64.deb
    sha:9a30320b9703da3501c12a6142d92cf0c37f1a17
  • alt-php73-dba_7.3.33-74_amd64.deb
    sha:082db5f1920d9e110a7ed4e36db21e7e245e93bc
  • alt-php73-dev_7.3.33-74_amd64.deb
    sha:91373a99bf54f2e24479f84d19a1935c39792fc6
  • alt-php73-enchant_7.3.33-74_amd64.deb
    sha:bedfade0ab247d19d0720a0405d0f444c0cf60e0
  • alt-php73-firebird_7.3.33-74_amd64.deb
    sha:0c1c23c3cc56715fd0e731ea4bb10617dfb7c126
  • alt-php73-gd_7.3.33-74_amd64.deb
    sha:92f71bd20340fc43a1c010dc21fe1b543960173d
  • alt-php73-imap_7.3.33-74_amd64.deb
    sha:3a75016e2a2cb9ff0278eadffd9a89d0ee35d400
  • alt-php73-intl_7.3.33-74_amd64.deb
    sha:5216b8ffa7f2f03ae801779cdae97ea9eac1d662
  • alt-php73-ldap_7.3.33-74_amd64.deb
    sha:d541837cbaac99f44d9c614c6a7896d14a124306
  • alt-php73-mbstring_7.3.33-74_amd64.deb
    sha:a0aaa12f5aad51157f8ed551a325270d42fcd1c7
  • alt-php73-mysqlnd_7.3.33-74_amd64.deb
    sha:88adb87a56c38f5256af50c9b50d6f38c528e339
  • alt-php73-odbc_7.3.33-74_amd64.deb
    sha:9f5e685effec97e15f550bd59400061dad88f1db
  • alt-php73-opcache_7.3.33-74_amd64.deb
    sha:f1ef10af4440cda02c1574630f4ad4cdb8614083
  • alt-php73-pdo_7.3.33-74_amd64.deb
    sha:02226236708810bc88407b40a85e0f1c5edd4acd
  • alt-php73-pgsql_7.3.33-74_amd64.deb
    sha:0253491a71cb8ed72828848205c6a77e0144ab5b
  • alt-php73-php-fpm_7.3.33-74_amd64.deb
    sha:f06804f17419f6c13adf6beca786e7060b841eaf
  • alt-php73-process_7.3.33-74_amd64.deb
    sha:2f081a8153656a86da31867363f64efc4d1ef4de
  • alt-php73-pspell_7.3.33-74_amd64.deb
    sha:e7305c0059164f7b812bf4f56cd0be77c47ff789
  • alt-php73-recode_7.3.33-74_amd64.deb
    sha:ef7ac2cc54a6c0356ad9be6505f90356e343ab2c
  • alt-php73-snmp_7.3.33-74_amd64.deb
    sha:c0e273c80602cd887c1b7c028264f04917ae8e69
  • alt-php73-soap_7.3.33-74_amd64.deb
    sha:2e45377ac238adffa80e4904916ff62e9d62bef6
  • alt-php73-sodium_7.3.33-74_amd64.deb
    sha:90211cb7db89b7377b1bea51b4e47775f4767a68
  • alt-php73-tidy_7.3.33-74_amd64.deb
    sha:788a5ea4b037c296942f3ed95b86ed3b143ab592
  • alt-php73-xml_7.3.33-74_amd64.deb
    sha:9fd8bc7595f2e9bd197c87e8bb00f1530d452e66
  • alt-php73-xmlrpc_7.3.33-74_amd64.deb
    sha:74690f855e513fec9918baf101e11fe453b5b145
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.