[CLSA-2026:1786381514] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-10 17:05:56 UTC
Description:
* CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped values escaped by PQescapeStringConn() in an E'...' escape-string constant, but that escaper leaves backslashes untouched when standard_conforming_strings is on, so a trailing backslash escaped the doubling quote and broke out of the literal. Drop the E prefix so the plain '...' form matches what the escaper produces. * CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed symlink chains by tail recursion with no cycle or depth guard, so a tar phar holding circular links exhausted the C stack. Walk the chain iteratively with Floyd cycle detection and return NULL on a loop; also restore the '/' separator in phar_get_link_location() so the walk stays idempotent.
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-29_amd64.deb
    sha:9b68ce17a000f09cb017ef2fdcea8fda0862e6e8
  • alt-php81-bcmath_8.1.34-29_amd64.deb
    sha:d4a85800a2207c88c16b862847677280b31e93d3
  • alt-php81-cli_8.1.34-29_amd64.deb
    sha:8b67b7d837369ad79d6c0f906e5d63773344db9c
  • alt-php81-common_8.1.34-29_amd64.deb
    sha:28d705ccc8e43241fa8bf451aba0d20a93f763f4
  • alt-php81-dba_8.1.34-29_amd64.deb
    sha:4df03c3bdc4b67ea142799ee0d46132195287ee9
  • alt-php81-dev_8.1.34-29_amd64.deb
    sha:1245916ca16077b15aa5bb60eba38bf3c0222ca7
  • alt-php81-enchant_8.1.34-29_amd64.deb
    sha:9709d278ccd034e873da447f092e75b3794c2f70
  • alt-php81-firebird_8.1.34-29_amd64.deb
    sha:f85e023446470ee687a0a62f8d2f32ced6bb778e
  • alt-php81-gd_8.1.34-29_amd64.deb
    sha:7e889b6ac2127838f909a609c1ab98fc8646692a
  • alt-php81-imap_8.1.34-29_amd64.deb
    sha:5f774b703982d8778a6827f9e8b73347c63b0eae
  • alt-php81-intl_8.1.34-29_amd64.deb
    sha:e7c34e1e7868c880081afa80f5c3c22d28110810
  • alt-php81-ldap_8.1.34-29_amd64.deb
    sha:65aa4473159b543a3975c1ca04b064a1ddec46d2
  • alt-php81-mbstring_8.1.34-29_amd64.deb
    sha:40c1b7601895f2b83d90bb17fd8dd777890b553c
  • alt-php81-mysqlnd_8.1.34-29_amd64.deb
    sha:f4b1894582ba467f1d578d15beb2a72647572022
  • alt-php81-odbc_8.1.34-29_amd64.deb
    sha:406edc2970e99280d0da9dee9042480492ac7eb3
  • alt-php81-opcache_8.1.34-29_amd64.deb
    sha:7c02bc86f20b0e22f1e3602e704ca5bb3b1f43d2
  • alt-php81-pdo_8.1.34-29_amd64.deb
    sha:77ce4c7e8505f1191586f528ce9564040ca67825
  • alt-php81-pgsql_8.1.34-29_amd64.deb
    sha:8736ac1cf76dd8f90ff7281c88441fcb5a18026f
  • alt-php81-php-fpm_8.1.34-29_amd64.deb
    sha:64ecbba2975b5b1f92707a5e834ec051a4e5ad3a
  • alt-php81-process_8.1.34-29_amd64.deb
    sha:dbce4782df13d922d8d0235fbec0ae7df380b556
  • alt-php81-pspell_8.1.34-29_amd64.deb
    sha:6ddc025da1b27e75cc9b4fdcb4c9683188786a3c
  • alt-php81-snmp_8.1.34-29_amd64.deb
    sha:a9d14d25ba2b055aa7c2562ee5a5e36067bcf708
  • alt-php81-soap_8.1.34-29_amd64.deb
    sha:3c13108287d292848a4b1da8b94957c3f75aa8c4
  • alt-php81-tidy_8.1.34-29_amd64.deb
    sha:2e135e6b728da61d24ac7c394a69aded06002ebd
  • alt-php81-xml_8.1.34-29_amd64.deb
    sha:8aa04fdb355eec4b28a420659e6b6474b25c422c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.