[CLSA-2026:1786371736] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-10 14:22:29 UTC
Description:
* SECURITY UPDATE: three defects in the bundled libgd GIF LZW decoder - debian/patches/php-7.1-CVE-2026-9672.patch: backport upstream commit fcd691b377 in ext/gd/libgd/gd_gif_in.c - reset sd->table[1][i] instead of sd->table[1][0] so the suffix table is fully cleared between images, stop decoding once the LZW end code is seen instead of falling through with a stale code, and zero-initialise LZW_STATIC_DATA in ReadImage(). - CVE-2026-9672 * SECURITY UPDATE: SQL injection in ext/pgsql via an E'...' backslash breakout - debian/patches/php-7.1-CVE-2026-17543.patch: backport upstream commit ab048bd83b in ext/pgsql/pgsql.c - php_pgsql_add_quotes() no longer emits the E prefix, since PQescapeStringConn() only doubles the single quote and a trailing backslash could therefore escape the closing quote of an E'...' literal. Test expectations updated accordingly and a regression test added. - CVE-2026-17543 * SECURITY UPDATE: phar crash on circular symlinks - debian/patches/php-7.1-CVE-2026-7260.patch: backport upstream commit 2e0fa0a444 in ext/phar/util.c - phar_get_link_source() follows the link chain with Floyd cycle detection via a new phar_follow_one_link() helper instead of recursing into itself until the C stack is exhausted, and phar_get_link_location() restores the path separator it temporarily overwrites in entry->filename. - CVE-2026-7260
CVEs fixed:
Updated packages:
  • alt-php71_7.1.33-105_amd64.deb
    sha:1491559d0e4fcac2548eada0db4c64b5362be00a
  • alt-php71-bcmath_7.1.33-105_amd64.deb
    sha:3aadc65040f07e6a5a84411b67a0e97551b08776
  • alt-php71-cli_7.1.33-105_amd64.deb
    sha:22125927624080fcbcd41212bc203c3659f4b49c
  • alt-php71-common_7.1.33-105_amd64.deb
    sha:45233c3a53ec79c684d7b2d82c21666a49dedc15
  • alt-php71-dba_7.1.33-105_amd64.deb
    sha:3afffe1031dda7bc39a52997faa46e3056b453e5
  • alt-php71-dev_7.1.33-105_amd64.deb
    sha:d805d4bc756e17c157b9466e1209926935469ce3
  • alt-php71-enchant_7.1.33-105_amd64.deb
    sha:c382b5a2c0f732b213a425516d2a896397f082c7
  • alt-php71-firebird_7.1.33-105_amd64.deb
    sha:514f5404772bded6c1fcea502ff0d6b95740c95f
  • alt-php71-gd_7.1.33-105_amd64.deb
    sha:24236fcc219f186e7bd319726a31c9a1c5b47864
  • alt-php71-imap_7.1.33-105_amd64.deb
    sha:30703a4ac0cd5c6b3f8aaa7995ab21fbe7c716cb
  • alt-php71-intl_7.1.33-105_amd64.deb
    sha:942222a544d74aac4107eea39d79258a4163a1b5
  • alt-php71-ldap_7.1.33-105_amd64.deb
    sha:ff549bdd42fc331bb07697a35c432255eae28af1
  • alt-php71-mbstring_7.1.33-105_amd64.deb
    sha:e4799734f73a69c361107789e2f448343d725e63
  • alt-php71-mcrypt_7.1.33-105_amd64.deb
    sha:68d1f505c23ced14f6a966c0bbd7c2a969fca471
  • alt-php71-mysqlnd_7.1.33-105_amd64.deb
    sha:f3289dea42bc262538092f2badb3731f3b3e3390
  • alt-php71-odbc_7.1.33-105_amd64.deb
    sha:53cf35fada05b346382c6dc6be61eded40a5f087
  • alt-php71-opcache_7.1.33-105_amd64.deb
    sha:1ab257298f97222316aaf86154e821df87e3afb8
  • alt-php71-pdo_7.1.33-105_amd64.deb
    sha:eff777f648c7199c6e17a60a16ce00d3200a2c16
  • alt-php71-pgsql_7.1.33-105_amd64.deb
    sha:f335157bcb5081ae26ae4fd8e3ba53e290696bb3
  • alt-php71-php-fpm_7.1.33-105_amd64.deb
    sha:23af236ce53664b2bcb62d2f07c450443558dea1
  • alt-php71-process_7.1.33-105_amd64.deb
    sha:9b0caab6af11f18fc43bc9e068a496314c4fa435
  • alt-php71-pspell_7.1.33-105_amd64.deb
    sha:f472779532b8c538e41bcb0d482b0e7b4a1fac7e
  • alt-php71-recode_7.1.33-105_amd64.deb
    sha:564e7feb7c95661461a279a4b689fb60c74de47e
  • alt-php71-snmp_7.1.33-105_amd64.deb
    sha:860aae3c51f7f4ee84af8e78093ded3f63c798ef
  • alt-php71-soap_7.1.33-105_amd64.deb
    sha:85dd578c46c918e84ccb5949e802c34592dd7366
  • alt-php71-tidy_7.1.33-105_amd64.deb
    sha:19ec13b10a26ce2281e706fd7ba5d1c6c3b1b1f7
  • alt-php71-xml_7.1.33-105_amd64.deb
    sha:789538f9bb906f693be6d2449380e190c16507d4
  • alt-php71-xmlrpc_7.1.33-105_amd64.deb
    sha:b6cdd3dd58b2289183e2d91d09d2ec569c0236d6
  • alt-php71_7.1.33-105_arm64.deb
    sha:34e0bff892607f9e535da638cc7e36bd577e5a54
  • alt-php71-bcmath_7.1.33-105_arm64.deb
    sha:85839cbe3f2be2608c4808dbf832caac953cce7d
  • alt-php71-cli_7.1.33-105_arm64.deb
    sha:6163d996c54c0e2aa3987a76d0bccd54956b6ce1
  • alt-php71-common_7.1.33-105_arm64.deb
    sha:c16724f9f4cbe2e3ebc3fea66dbf0605c185e5fc
  • alt-php71-dba_7.1.33-105_arm64.deb
    sha:3a1e917e9533f40b13fa11f74d59712c97e845f7
  • alt-php71-dev_7.1.33-105_arm64.deb
    sha:653df0a3440ed19abb2224b3e7a5d0eead0e3b41
  • alt-php71-enchant_7.1.33-105_arm64.deb
    sha:9662f7fde8ac908f76c96c8e984d3e2288653422
  • alt-php71-firebird_7.1.33-105_arm64.deb
    sha:ca77cbe36511585b512bc0bc86679d787bde82c6
  • alt-php71-gd_7.1.33-105_arm64.deb
    sha:86461a46bbe55859faec2b9804f99474c7eb2d55
  • alt-php71-imap_7.1.33-105_arm64.deb
    sha:968206ba4c6352f5c44a45ff4e05a877351ee0e9
  • alt-php71-intl_7.1.33-105_arm64.deb
    sha:0be159a19a7dafd1db2efe685da5b5cc99071947
  • alt-php71-ldap_7.1.33-105_arm64.deb
    sha:fe79065351a2669352ae86ea7e6061e606e77010
  • alt-php71-mbstring_7.1.33-105_arm64.deb
    sha:e28b057349eaea84d22a875d9df226c7f3089a50
  • alt-php71-mcrypt_7.1.33-105_arm64.deb
    sha:d609c31875194e5598753d659c9224c156aea46a
  • alt-php71-mysqlnd_7.1.33-105_arm64.deb
    sha:ce16d6acaf0207d9f093de8294316420a0972749
  • alt-php71-odbc_7.1.33-105_arm64.deb
    sha:0d9042bffb8d610056435607b06fb06c68efb6d1
  • alt-php71-opcache_7.1.33-105_arm64.deb
    sha:5507286c24a53af7dffcb52f10806ffde2dfc6c5
  • alt-php71-pdo_7.1.33-105_arm64.deb
    sha:42d958fc24e2250b867d8a27108b310ef0cacee4
  • alt-php71-pgsql_7.1.33-105_arm64.deb
    sha:96e32fc58a105d169a6e0eba35f8c49d10869172
  • alt-php71-php-fpm_7.1.33-105_arm64.deb
    sha:21fc3b8ae2c222185e28bdbfa6e74a9cdb932494
  • alt-php71-process_7.1.33-105_arm64.deb
    sha:09c559f58641e97cc1afa3c26847f42ea4474ad6
  • alt-php71-pspell_7.1.33-105_arm64.deb
    sha:a8a195b0b9759f69d4b6b338d091fc58e5f097db
  • alt-php71-recode_7.1.33-105_arm64.deb
    sha:1d3430839ce48aaaa2a4c8da942d3e44d612cd4e
  • alt-php71-snmp_7.1.33-105_arm64.deb
    sha:986bcbb4b5b9474101b049accd1e1decb88e2685
  • alt-php71-soap_7.1.33-105_arm64.deb
    sha:cf82f6405f78023e5d6b56cf495061211b74e5b1
  • alt-php71-tidy_7.1.33-105_arm64.deb
    sha:fdf1b18e22eb69a1a8a342c29ce6c40ef2c9894a
  • alt-php71-xml_7.1.33-105_arm64.deb
    sha:fe385ecaa1a4ee2ba1014fb580814d4cf8409c37
  • alt-php71-xmlrpc_7.1.33-105_arm64.deb
    sha:e3e9b3c279f6ce71b76728080c12cfbaf36037ae
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.