[CLSA-2026:1786372812] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-10 14:40:27 UTC
Description:
* CVE-2026-9672: fix three defects in the bundled libgd GIF LZW decoder reachable from attacker-controlled GIF data via imagecreatefromgif(). The table reset cleared sd->table[1][0] instead of sd->table[1][i], so stale suffixes leaked between images; LWZReadByte_() kept decoding with a stale code after the LZW end code when the trailing data block count was 0; and ReadImage() left LZW_STATIC_DATA uninitialised. * CVE-2026-17543: fix SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped PQescapeStringConn() output in an E'...' literal, but PQescapeStringConn() only doubles the single quote while standard_conforming_strings is on, so a trailing backslash escaped the closing quote and broke out of the literal in pg_convert()/pg_insert()/pg_update()/pg_select()/pg_delete(). Emit a plain '...' literal instead. * CVE-2026-7260: fix unbounded recursion in phar_get_link_source() on a circular symlink chain (GHSA-vc5h-9ppw-p5f3). The self-recursion is replaced by a Floyd cycle-detection walk that returns NULL for a cycle, including the phar_get_link_location() path-separator restore the walk depends on.
CVEs fixed:
Updated packages:
  • alt-php72_7.2.34-89_amd64.deb
    sha:47f8ad216a9c6d706c63adb1c6e6db2d26116ac3
  • alt-php72-bcmath_7.2.34-89_amd64.deb
    sha:e964de3e13152e49262232c7fffafc60c0f5de2b
  • alt-php72-cli_7.2.34-89_amd64.deb
    sha:0d7c7726d0258354d634a96e21c0998e80b1446f
  • alt-php72-common_7.2.34-89_amd64.deb
    sha:eecaa0a4f3f96fab37c40b110e8acec7c5c522b1
  • alt-php72-dba_7.2.34-89_amd64.deb
    sha:85695a6ba3a6ddd1b6691a8d0415e07852d43f88
  • alt-php72-dev_7.2.34-89_amd64.deb
    sha:9702949e8311bcbe1b4f3610b875bb3c94e452db
  • alt-php72-enchant_7.2.34-89_amd64.deb
    sha:383f3eb0bf2d8f8437593208e7412f6a4f99cd10
  • alt-php72-firebird_7.2.34-89_amd64.deb
    sha:bbfe0cd4b11abb0df83cb67c0b1f5a40bc1f37ec
  • alt-php72-gd_7.2.34-89_amd64.deb
    sha:aacfa748b684a7585f141bc18bda83f84d5772e3
  • alt-php72-imap_7.2.34-89_amd64.deb
    sha:e595c28ff2ed7d8b33e7114a2dd7eb56b7d9ffe4
  • alt-php72-intl_7.2.34-89_amd64.deb
    sha:3ad8fade9bce2e1d0091f89f1bb4aa24034d0090
  • alt-php72-ldap_7.2.34-89_amd64.deb
    sha:b03e3ac870159b0eb4cd4dfcf64f17d580e31109
  • alt-php72-mbstring_7.2.34-89_amd64.deb
    sha:d2bbf7e4b38a140348d4aea742d2171dac589044
  • alt-php72-mysqlnd_7.2.34-89_amd64.deb
    sha:6dee6e0d95129f39e620bdef23a2cb39b24fa064
  • alt-php72-odbc_7.2.34-89_amd64.deb
    sha:d848fec7b55c3ba8b12de2a09cf7731cff76053b
  • alt-php72-opcache_7.2.34-89_amd64.deb
    sha:a13a268fff9ea5e9065502a57fda84060dc7bdc0
  • alt-php72-pdo_7.2.34-89_amd64.deb
    sha:49e8aa2bf73c660329992465c58910466480f7ef
  • alt-php72-pgsql_7.2.34-89_amd64.deb
    sha:483a853030d2d2ca0e69707cd7c26cc9b900ec1f
  • alt-php72-php-fpm_7.2.34-89_amd64.deb
    sha:5358a2b24f61351b02a227014f494309992fa5eb
  • alt-php72-process_7.2.34-89_amd64.deb
    sha:84e9d589829ffaf77b42a17b4af6b6abd20e28bf
  • alt-php72-pspell_7.2.34-89_amd64.deb
    sha:42a402c61c74f8a1584c7a8fda2f1e25184a16c8
  • alt-php72-recode_7.2.34-89_amd64.deb
    sha:f1c10d1f771d441b26af8faea535bd92e38794a9
  • alt-php72-snmp_7.2.34-89_amd64.deb
    sha:75b7b48324cf64e50bbfa59ce5ae6626e9c7fc8f
  • alt-php72-soap_7.2.34-89_amd64.deb
    sha:d93d4fd05fba2726c75e66417a301494daa9f52d
  • alt-php72-sodium_7.2.34-89_amd64.deb
    sha:8a5a87d9aa4cff45708eb00126377c8c48f49d33
  • alt-php72-tidy_7.2.34-89_amd64.deb
    sha:247c15643b159fad020511324c1b87567b751041
  • alt-php72-xml_7.2.34-89_amd64.deb
    sha:e0aa81e0fa9f3ff23798bc94240baa1f05585961
  • alt-php72-xmlrpc_7.2.34-89_amd64.deb
    sha:4e82430bc698c1cb733c4b1c5963832034f78c2b
  • alt-php72_7.2.34-89_arm64.deb
    sha:6582a5de70462c65687510f7858463fddb767c6e
  • alt-php72-bcmath_7.2.34-89_arm64.deb
    sha:4eb19c0aa9f608134b52fbbb95c666fb70dedfc6
  • alt-php72-cli_7.2.34-89_arm64.deb
    sha:f092553093c3506385847620e67bb8831c4dd816
  • alt-php72-common_7.2.34-89_arm64.deb
    sha:0005b031f6bc0fe03a38625554b08bdd6aee4dd7
  • alt-php72-dba_7.2.34-89_arm64.deb
    sha:a7220fe40e5b6464c2a79cf81f808bce09d2c681
  • alt-php72-dev_7.2.34-89_arm64.deb
    sha:bab8e79a9d7148724b101f6d76c8c8ce36a09e09
  • alt-php72-enchant_7.2.34-89_arm64.deb
    sha:e29688d19f9f33f1cb237e0b28791378c673b7da
  • alt-php72-firebird_7.2.34-89_arm64.deb
    sha:91a73e6fd375fd7666ef1bf6c7a6996b093cb9e7
  • alt-php72-gd_7.2.34-89_arm64.deb
    sha:bceeeaf99bc0e72c29a1ecafb11cc8d9a0beb06a
  • alt-php72-imap_7.2.34-89_arm64.deb
    sha:92e74e8736043a9b7cd7be14c16844dfa8942327
  • alt-php72-intl_7.2.34-89_arm64.deb
    sha:3e19875a73a0c9288d6344d4f524e3cf99ba36c1
  • alt-php72-ldap_7.2.34-89_arm64.deb
    sha:c8d45cdbac272df5c66592fa3c7560a9055d3c7c
  • alt-php72-mbstring_7.2.34-89_arm64.deb
    sha:200d3b6158ced3d43142a331272fab5fd4da6737
  • alt-php72-mysqlnd_7.2.34-89_arm64.deb
    sha:b0a098c677a7fda930fca7bdd5fbbf29ed7b17ed
  • alt-php72-odbc_7.2.34-89_arm64.deb
    sha:fd22ce5807ecf40e9dd153cc11b169eec862b40c
  • alt-php72-opcache_7.2.34-89_arm64.deb
    sha:a8dceedd87abf05519877ccd1595adff7a89000c
  • alt-php72-pdo_7.2.34-89_arm64.deb
    sha:d2cf2f9ffc4badbd2d168dcc86ac4e5f373fa243
  • alt-php72-pgsql_7.2.34-89_arm64.deb
    sha:bfb671a187f607ec725f717d42d5b60b1d631495
  • alt-php72-php-fpm_7.2.34-89_arm64.deb
    sha:af19a7573466cc986abc5310c089fb4dcf865e5f
  • alt-php72-process_7.2.34-89_arm64.deb
    sha:001e524e5763de888d43222ae95c3fe3755705a2
  • alt-php72-pspell_7.2.34-89_arm64.deb
    sha:fd3836b9dfdaee7b93a5775590c7d30a5f1b503b
  • alt-php72-recode_7.2.34-89_arm64.deb
    sha:3bae73405b1bd5ecd0f0e3d0ff63e9e185c50874
  • alt-php72-snmp_7.2.34-89_arm64.deb
    sha:a34d49f59305da89d00b6ab7eca62e6e0df64ba8
  • alt-php72-soap_7.2.34-89_arm64.deb
    sha:4b49011b276a2d4f2d4d46900a3c63c569c39963
  • alt-php72-sodium_7.2.34-89_arm64.deb
    sha:8572d776c4fca6f60bb36534dd318f07d7082ebb
  • alt-php72-tidy_7.2.34-89_arm64.deb
    sha:a98e59cd944fe37e307c83dad286d15405a13f2e
  • alt-php72-xml_7.2.34-89_arm64.deb
    sha:944386e56a95b7d2a8c3b556eb576aa50d62249f
  • alt-php72-xmlrpc_7.2.34-89_arm64.deb
    sha:6f54765767642f9803a016e0b63c2715c83677e0
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.