[CLSA-2026:1786391249] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-10 19:47:45 UTC
Description:
* CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an end-of-stream code * CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-74_amd64.deb
    sha:4ecb708eb316889968665fc03682c41d6fa482a9
  • alt-php73-bcmath_7.3.33-74_amd64.deb
    sha:8d057989932dcf12e80dcf2c48a7c9ad4562af90
  • alt-php73-cli_7.3.33-74_amd64.deb
    sha:f67200e133e976809198f8a55eaf2c64820896a8
  • alt-php73-common_7.3.33-74_amd64.deb
    sha:a27da1fef48925cf1bb815c5dc0d57ce12fde315
  • alt-php73-dba_7.3.33-74_amd64.deb
    sha:8dd7efea3682ea3e0a8ac1d3f06c52fe32a0f200
  • alt-php73-dev_7.3.33-74_amd64.deb
    sha:8a9063a29f3b927224aab1a2672dfe0e219684db
  • alt-php73-enchant_7.3.33-74_amd64.deb
    sha:fa446b789d0c26f6fb50231e29a15621da2abbb2
  • alt-php73-firebird_7.3.33-74_amd64.deb
    sha:d5ea96feefe1aa203decf8c8b1b6f704a6a850c0
  • alt-php73-gd_7.3.33-74_amd64.deb
    sha:db38947e8b0f7b7210aaf780ebac39f008da8383
  • alt-php73-imap_7.3.33-74_amd64.deb
    sha:8a3f9292f270bff70948dbb15e75c342e8a8139a
  • alt-php73-intl_7.3.33-74_amd64.deb
    sha:ac695ee4f3da4bd271e00f26c36a2e3b10e58237
  • alt-php73-ldap_7.3.33-74_amd64.deb
    sha:4a7c500737c143267aed1ddc4cf55107bfe15f3b
  • alt-php73-mbstring_7.3.33-74_amd64.deb
    sha:344b88ca8b4f9de95e48685e557dbdf3b022990e
  • alt-php73-mysqlnd_7.3.33-74_amd64.deb
    sha:371a07d8c07feaef387126d9260f3a1c58982636
  • alt-php73-odbc_7.3.33-74_amd64.deb
    sha:e85b039781e187841d9a21215bb7e85ca4b9b165
  • alt-php73-opcache_7.3.33-74_amd64.deb
    sha:a8146d5f5fd099a4879f75ddca5164f846b81fc9
  • alt-php73-pdo_7.3.33-74_amd64.deb
    sha:f4e2f3d4be72b9b6bd82e9e8368dde557649583a
  • alt-php73-pgsql_7.3.33-74_amd64.deb
    sha:c5c094afc035cfd505305622bdd0b1f2b6ac89e1
  • alt-php73-php-fpm_7.3.33-74_amd64.deb
    sha:9acc0cf5af8e6dd2c5099046863514eafb4223fe
  • alt-php73-process_7.3.33-74_amd64.deb
    sha:b88e9587ebf33c76609a65321f643f5fccca0f18
  • alt-php73-pspell_7.3.33-74_amd64.deb
    sha:a4b29813dab5f54c18410e39f3858f0b290f4497
  • alt-php73-recode_7.3.33-74_amd64.deb
    sha:f1d1f70fc1b8f328e8795a4644c0e9cdaa38109b
  • alt-php73-snmp_7.3.33-74_amd64.deb
    sha:062496e26b7cfcd42af81c11d487519eb5b8ebd6
  • alt-php73-soap_7.3.33-74_amd64.deb
    sha:f057ea7090f5746c476f2839b2d8a795299941dd
  • alt-php73-sodium_7.3.33-74_amd64.deb
    sha:533177423d1667ad61594bd6309e4123b10d0d1b
  • alt-php73-tidy_7.3.33-74_amd64.deb
    sha:269cb0033f52cc7837b3084f8b906f8b86df4182
  • alt-php73-xml_7.3.33-74_amd64.deb
    sha:925be5f62ee1ee18ec3e5fb7ae5b86b5495f4844
  • alt-php73-xmlrpc_7.3.33-74_amd64.deb
    sha:431fe2ff4cd78e7eed6851e819a357e75cba2d5d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.