[CLSA-2026:1786517269] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-12 06:48:02 UTC
Description:
* SECURITY UPDATE: three defects in the bundled libgd GIF LZW decoder - debian/patches/php-7.1-CVE-2026-9672.patch: backport upstream commit fcd691b377 in ext/gd/libgd/gd_gif_in.c - reset sd->table[1][i] instead of sd->table[1][0] so the suffix table is fully cleared between images, stop decoding once the LZW end code is seen instead of falling through with a stale code, and zero-initialise LZW_STATIC_DATA in ReadImage(). - CVE-2026-9672 * SECURITY UPDATE: SQL injection in ext/pgsql via an E'...' backslash breakout - debian/patches/php-7.1-CVE-2026-17543.patch: backport upstream commit ab048bd83b in ext/pgsql/pgsql.c - php_pgsql_add_quotes() no longer emits the E prefix, since PQescapeStringConn() only doubles the single quote and a trailing backslash could therefore escape the closing quote of an E'...' literal. Test expectations updated accordingly and a regression test added. - CVE-2026-17543 * SECURITY UPDATE: phar crash on circular symlinks - debian/patches/php-7.1-CVE-2026-7260.patch: backport upstream commit 2e0fa0a444 in ext/phar/util.c - phar_get_link_source() follows the link chain with Floyd cycle detection via a new phar_follow_one_link() helper instead of recursing into itself until the C stack is exhausted, and phar_get_link_location() restores the path separator it temporarily overwrites in entry->filename. - CVE-2026-7260
CVEs fixed:
Updated packages:
  • alt-php71_7.1.33-105_amd64.deb
    sha:1491559d0e4fcac2548eada0db4c64b5362be00a
  • alt-php71-bcmath_7.1.33-105_amd64.deb
    sha:1f7234c7ff72b1a63fec809fc717d9ea1feb9906
  • alt-php71-cli_7.1.33-105_amd64.deb
    sha:fb84214bc4a6a73bb278813a522152930213a5c5
  • alt-php71-common_7.1.33-105_amd64.deb
    sha:fd770e5d93d4bb14c85cd6c84bc01814eb0834ac
  • alt-php71-dba_7.1.33-105_amd64.deb
    sha:85e0ebcaf3971def6988b51eafe2fb928bf23a92
  • alt-php71-dev_7.1.33-105_amd64.deb
    sha:b9be82f450f8f149b91dc03dca442c8ec25977e2
  • alt-php71-enchant_7.1.33-105_amd64.deb
    sha:47be8f5c54d302288f9c43094f007e707c8b00c6
  • alt-php71-firebird_7.1.33-105_amd64.deb
    sha:edaccb767f920bb312406f5aa138df174ea77f5c
  • alt-php71-gd_7.1.33-105_amd64.deb
    sha:23557151e43abe3974e9fc42df32ef301498ba28
  • alt-php71-imap_7.1.33-105_amd64.deb
    sha:d7076af2419ddb2b8f5e9cfc096a2452a9a3dced
  • alt-php71-intl_7.1.33-105_amd64.deb
    sha:080885bd1b76ad786162feea9075f8226506c355
  • alt-php71-ldap_7.1.33-105_amd64.deb
    sha:9f2672831313c6eea79b06eb60fa6cbc2986f321
  • alt-php71-mbstring_7.1.33-105_amd64.deb
    sha:11f7e0211767ed1a578bd54968727259f6fe1741
  • alt-php71-mcrypt_7.1.33-105_amd64.deb
    sha:9fcd49f797bac7d94be75ad675fff77378718ace
  • alt-php71-mysqlnd_7.1.33-105_amd64.deb
    sha:c0e6053d2587fac1370cb317b03d3b6097e21020
  • alt-php71-odbc_7.1.33-105_amd64.deb
    sha:b522711693ba3cb5c3d7de21b65cc02f5e20561a
  • alt-php71-opcache_7.1.33-105_amd64.deb
    sha:1750ab89d259eec2130c4b4f9d7f331943eb6489
  • alt-php71-pdo_7.1.33-105_amd64.deb
    sha:a6bc816479045f682c5a3d3b687d7390483e9e4b
  • alt-php71-pgsql_7.1.33-105_amd64.deb
    sha:26f86716c030d0f727a85e4b30d1a0720b4832be
  • alt-php71-php-fpm_7.1.33-105_amd64.deb
    sha:a678722023aa78699acc07fa5cd916244f6e41d1
  • alt-php71-process_7.1.33-105_amd64.deb
    sha:9061c0b5d29f3c6efea90bbafcdb01afeb9fe148
  • alt-php71-pspell_7.1.33-105_amd64.deb
    sha:515c8413955eaa475c8a892118c6e27da8dea01f
  • alt-php71-recode_7.1.33-105_amd64.deb
    sha:6a83cdd29324e07f1bb7b1514035aa10374562ed
  • alt-php71-snmp_7.1.33-105_amd64.deb
    sha:ac6551d89498ee5c2ee764eb5355c824d65c3da7
  • alt-php71-soap_7.1.33-105_amd64.deb
    sha:a91c052040a902f98c368f2b6f442a84f2f25c57
  • alt-php71-tidy_7.1.33-105_amd64.deb
    sha:e5db3a798e9b25e3622d84d9c36e7f69f818a206
  • alt-php71-xml_7.1.33-105_amd64.deb
    sha:9a2a2e7273c8e3052619e291db90c2b93951a663
  • alt-php71-xmlrpc_7.1.33-105_amd64.deb
    sha:4cf4323aa70877415df92c0a09245b45a702e269
  • alt-php71_7.1.33-105_arm64.deb
    sha:34e0bff892607f9e535da638cc7e36bd577e5a54
  • alt-php71-bcmath_7.1.33-105_arm64.deb
    sha:bca1d6530f62ff98a25695e9e09f6060933d9d86
  • alt-php71-cli_7.1.33-105_arm64.deb
    sha:ce60f0002352ff4ff14b5100a4412d6352bddcd9
  • alt-php71-common_7.1.33-105_arm64.deb
    sha:6ded8de5cc62662b57e5e1e24238d43bb0f2c30c
  • alt-php71-dba_7.1.33-105_arm64.deb
    sha:352fbdc30ddcd7a9bb0c3986a1679e5e6bddcb3d
  • alt-php71-dev_7.1.33-105_arm64.deb
    sha:b77ffdfe5490e7c3044b536a6f58e08641664ccf
  • alt-php71-enchant_7.1.33-105_arm64.deb
    sha:ece8efd58aa6b1ee3f46ceed10f0d0e7a522f538
  • alt-php71-firebird_7.1.33-105_arm64.deb
    sha:656fd01cf86159efd6d73d08ab270af5d05af0ce
  • alt-php71-gd_7.1.33-105_arm64.deb
    sha:b2d392c7b98b16c3d3376d2c074cf24dfe21efec
  • alt-php71-imap_7.1.33-105_arm64.deb
    sha:b045b015041ce68106164712a74d76cf62e7b23e
  • alt-php71-intl_7.1.33-105_arm64.deb
    sha:18d6287d469047e3785a51ab8babf62c34be19a0
  • alt-php71-ldap_7.1.33-105_arm64.deb
    sha:9d7ec1c68962cb6899afd440da07b37d07b42513
  • alt-php71-mbstring_7.1.33-105_arm64.deb
    sha:a3945d211eb039a7375aa07074adeb643db04a75
  • alt-php71-mcrypt_7.1.33-105_arm64.deb
    sha:e324f10383a2524ae62f306122de2e2cfb50a2f3
  • alt-php71-mysqlnd_7.1.33-105_arm64.deb
    sha:8b748dc8c7482ea0b30869e89de95c9df0db8828
  • alt-php71-odbc_7.1.33-105_arm64.deb
    sha:6ffce470d0a7993588ce79ec0f18a72b110dc3cc
  • alt-php71-opcache_7.1.33-105_arm64.deb
    sha:7e514c8feb0950186584568d1e69aa134e541cc2
  • alt-php71-pdo_7.1.33-105_arm64.deb
    sha:d0afc921bff7b9d65a41a96527adb1259ddd54fc
  • alt-php71-pgsql_7.1.33-105_arm64.deb
    sha:9c13acc71ce687740718e18f1dde4db127b200e2
  • alt-php71-php-fpm_7.1.33-105_arm64.deb
    sha:68ab98bfb87bcdec7f42bc2c1acff008882714b7
  • alt-php71-process_7.1.33-105_arm64.deb
    sha:2baca9a9726c8a3c6180cfa1b939ba392faf8e47
  • alt-php71-pspell_7.1.33-105_arm64.deb
    sha:56bbb45160babf2bf06cc299b2d9b2f4d94b17b4
  • alt-php71-recode_7.1.33-105_arm64.deb
    sha:31c0f48a8d1ef018c8038b623f0a4df4fff48412
  • alt-php71-snmp_7.1.33-105_arm64.deb
    sha:8cf69c13be624a29b8fab1e2738f8e1d0c4ecb90
  • alt-php71-soap_7.1.33-105_arm64.deb
    sha:cf18bbace96ca004a2ec907742f358ef1a7454b1
  • alt-php71-tidy_7.1.33-105_arm64.deb
    sha:5e90b77436d55578d013d0047156a6ba158a84e4
  • alt-php71-xml_7.1.33-105_arm64.deb
    sha:e04b81f71d61e86480f81a29c26f0d274b94f282
  • alt-php71-xmlrpc_7.1.33-105_arm64.deb
    sha:39f61fc06ae7b60e610f4cb953fd1cad49921c78
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.