[CLSA-2026:1786393818] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-10 20:30:32 UTC
Description:
* CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an end-of-stream code * CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-74_amd64.deb
    sha:ff61e73d6595129f4688e810e5c6fe7462f27029
  • alt-php73-bcmath_7.3.33-74_amd64.deb
    sha:63b12fb84cfd0445ea1d52d3bc601c2cd9a0c4cf
  • alt-php73-cli_7.3.33-74_amd64.deb
    sha:e5ba7250cb93fa3726428727f9e0bb7b28ced2ca
  • alt-php73-common_7.3.33-74_amd64.deb
    sha:efd84fd62cb25b497227b1952b05c73603313ad6
  • alt-php73-dba_7.3.33-74_amd64.deb
    sha:08703c3200c0cc8045c0197456f331c29f587108
  • alt-php73-dev_7.3.33-74_amd64.deb
    sha:65b8b44b66f6f2fe9593652392af639c7b4dc865
  • alt-php73-enchant_7.3.33-74_amd64.deb
    sha:574e858f6d4d550aeedcdee9b6f9f21279fa2700
  • alt-php73-firebird_7.3.33-74_amd64.deb
    sha:a1d11ccdec74c57976e0dcb4e4ef9231d858add8
  • alt-php73-gd_7.3.33-74_amd64.deb
    sha:ccd68d7f52e74bd2242ffe425866f9c83ecbf309
  • alt-php73-imap_7.3.33-74_amd64.deb
    sha:5218452d7ab49126c05e70ca97f4d48fe7709db9
  • alt-php73-intl_7.3.33-74_amd64.deb
    sha:dee95fb9d81315200f571668fdaa2465d3fd35ce
  • alt-php73-ldap_7.3.33-74_amd64.deb
    sha:3e645e35383a03340ad56d54a57b41ea48ff57d2
  • alt-php73-mbstring_7.3.33-74_amd64.deb
    sha:2ddb27d3abcea552fe3fe0fb666b086712ed0236
  • alt-php73-mysqlnd_7.3.33-74_amd64.deb
    sha:ad9ae47ad8bacd77c1dda51c8ed19cfd5856dca4
  • alt-php73-odbc_7.3.33-74_amd64.deb
    sha:18d421eac75d1ffa1d71b85fba2cad79b6ff4a4e
  • alt-php73-opcache_7.3.33-74_amd64.deb
    sha:fd1f83f515f7403685af0d14c04ff0eeda92a0c2
  • alt-php73-pdo_7.3.33-74_amd64.deb
    sha:7eda2b739396288791669ec1e024accfedeb5b31
  • alt-php73-pgsql_7.3.33-74_amd64.deb
    sha:922bf9d0a4dd18753e6f0bba0932579caf7364f0
  • alt-php73-php-fpm_7.3.33-74_amd64.deb
    sha:1f9a0bc1473da59ccf23772ad27b20969126bd76
  • alt-php73-process_7.3.33-74_amd64.deb
    sha:9a890eac31bf8937c75aabf1099d8bae9b5dff5f
  • alt-php73-pspell_7.3.33-74_amd64.deb
    sha:d81512e5a7d0459aa2d037a3fe3a481df8828b35
  • alt-php73-recode_7.3.33-74_amd64.deb
    sha:7dea57b24c25516cdcfe033e4323a95193020cba
  • alt-php73-snmp_7.3.33-74_amd64.deb
    sha:008c0b00f83e8b5dc46ec5abc1a37f3dd5112b26
  • alt-php73-soap_7.3.33-74_amd64.deb
    sha:4f2eb609d739f445517019071fb587eff48218e2
  • alt-php73-tidy_7.3.33-74_amd64.deb
    sha:8285238c01a9c29ba27f54047cb2b85e69ea7c03
  • alt-php73-xml_7.3.33-74_amd64.deb
    sha:12105d3a0988a26018a036fb5b14a8be1a7e7b65
  • alt-php73-xmlrpc_7.3.33-74_amd64.deb
    sha:ddd8973a6d3a3e005573bf05e5bcd75a0e6620e7
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.