* SECURITY UPDATE: three defects in the GIF LZW decoder of the bundled libgd - debian/patches/php-5.6-CVE-2026-9672.patch: backport upstream commit fcd691b377d0 (libgd patch by Pierre Joye) in ext/gd/libgd/gd_gif_in.c. The prefix/suffix table reset in LWZReadByte_() cleared table[1][0] repeatedly instead of table[1][i], so table[1] was only initialised up to clear_code and the entries above it kept indeterminate stack contents; the LZW end_code branch fell through and kept decoding with a stale code when the trailing data blocks drained cleanly, which is what lets those bytes reach output pixels; and ReadImage() left its LZW_STATIC_DATA scratch struct uninitialised. All three are reachable from attacker-controlled GIF data via imagecreatefromgif(). - Note: byte-identical to upstream, only the context line numbers differ. - CVE-2026-9672 * SECURITY UPDATE: SQL injection in ext/pgsql via E'...' backslash breakout - debian/patches/php-5.6-CVE-2026-17543.patch: backport upstream commit ab048bd83b57 (GHSA-7qpv-r5mr-78m4) in ext/pgsql/pgsql.c. php_pgsql_add_quotes() wrapped a PQescapeStringConn()-escaped value in an E'...' literal, where a backslash is an escape character, but PQescapeStringConn() only doubles backslashes when the connection has standard_conforming_strings off. A value such as "zzz\' OR 1=1 --" therefore escaped the doubled quote and broke out of the literal, letting pg_convert(), pg_insert(), pg_update(), pg_delete() and pg_select() inject arbitrary SQL. Emit a plain '...' literal instead, which is what PQescapeStringConn() is documented to be used with. - Note: 5.6 builds the literal with smart_str rather than upstream's zend_string_concat3(), so the fix drops the smart_str_appendc(&str, 'E') call. The pg_convert()/pg_insert()/pg_update() expectations are updated for the dropped E prefix, including the 5.6-era non-"_9" duplicates upstream no longer ships, and a 5.6-compatible replacement for the upstream regression test is added. - CVE-2026-17543 * SECURITY UPDATE: phar stack exhaustion on a circular symlink chain - debian/patches/php-5.6-CVE-2026-7260.patch: backport upstream commit 2e0fa0a44441 (GHSA-vc5h-9ppw-p5f3) in ext/phar/util.c. phar_get_link_source() resolved a symlink by tail-calling itself with no cycle detection, so a tar-based archive whose symlinks form a loop exhausted the stack and crashed the process on open or read. A new static phar_follow_one_link() now performs a single hop and phar_get_link_source() walks the chain iteratively with Floyd tortoise-and-hare cycle detection, returning NULL on a cycle. - Note: kept on the 5.6 zend_hash_find()/TSRMLS API instead of upstream's zend_hash_str_find_ptr(). Upstream follow-up 56b8d1040d83 is not included because phar_get_link_location() can still return entry->link itself here, so the "if (link != entry->link)" efree guard is required. - Note: also restores the path separator in phar_get_link_location() ("*p = '/'"), without which the Floyd walk's second visit to an entry resolves a truncated prefix, both manifest lookups miss, and the slow cursor is dereferenced as NULL - crashing on *valid* nested archives. Upstream carries the same defect but its fixtures use flat entry names and never reach that branch. - Note: the .phpt from 2e0fa0a is not backported - it ships three binary tar fixtures, which a 3.0 (quilt) source package cannot carry. Instead this adds ext/phar/tests/tar/gh21986.phpt from b2de3cf170, the earlier public fix for the same defect, which builds the circular-symlink tar programmatically in pure PHP; only its --EXTENSIONS-- header is changed to the 5.6-equivalent --SKIPIF--. It fails (SIGSEGV) on an unpatched 5.6.40 build and passes on a patched one. Also verified with a standalone ASan/UBSan harness over the patched functions (13 cases: cycles resolve to NULL, acyclic and nested relative chains still resolve, zero allocation balance). - CVE-2026-7260