[CLSA-2026:1786520076] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-12 07:34:50 UTC
Description:
* CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php74_7.4.33-70_amd64.deb
    sha:5e03600abca098045c0701ff7d86dde9be1c3156
  • alt-php74-bcmath_7.4.33-70_amd64.deb
    sha:545c6e8eecdc07d1065a20037c307a923bbd7f9c
  • alt-php74-cli_7.4.33-70_amd64.deb
    sha:416d0b3fd5366abe1d09f564ace1f892ef758d79
  • alt-php74-common_7.4.33-70_amd64.deb
    sha:385a6944f7f514211159b32942f5422f870b292c
  • alt-php74-dba_7.4.33-70_amd64.deb
    sha:e9b09347d3f9096c4c46222159e3c019e4e1bf53
  • alt-php74-dev_7.4.33-70_amd64.deb
    sha:378b2a04b22e82e4d9bb91cbcebb29a2af62be8e
  • alt-php74-enchant_7.4.33-70_amd64.deb
    sha:17e00dbd34c6508b32923d431078780185471997
  • alt-php74-firebird_7.4.33-70_amd64.deb
    sha:184cb62717c40fff54acaef80e8308600526683d
  • alt-php74-gd_7.4.33-70_amd64.deb
    sha:db38f8597378db2c9d2e644a5361e31d35e0a446
  • alt-php74-imap_7.4.33-70_amd64.deb
    sha:3a63372d2b9de5e17df259ae0a76c3ad075ff376
  • alt-php74-intl_7.4.33-70_amd64.deb
    sha:99afe4da476b3fe84c610036dcb07f97258eabe6
  • alt-php74-ldap_7.4.33-70_amd64.deb
    sha:c597fef430ec929aaef7dce1bf4441df5b553f02
  • alt-php74-mbstring_7.4.33-70_amd64.deb
    sha:e8a90fa76c8125b660d8838ec1d50b49ab33804f
  • alt-php74-mysqlnd_7.4.33-70_amd64.deb
    sha:46d36634e40c830a3238869d211b7be5cf1e9c63
  • alt-php74-odbc_7.4.33-70_amd64.deb
    sha:c2562d60f1f1a2a8f0ca26c14b803c2b66bdf26b
  • alt-php74-opcache_7.4.33-70_amd64.deb
    sha:622b45b846e72b5c77394dea41f42a719b13affd
  • alt-php74-pdo_7.4.33-70_amd64.deb
    sha:1b7671f2735629bdde29bd3422c0f4c661d18ae9
  • alt-php74-pgsql_7.4.33-70_amd64.deb
    sha:0e05f7492ae047bf8af1f5c436e4a245a95687d3
  • alt-php74-php-fpm_7.4.33-70_amd64.deb
    sha:10b24812ce8d53be71ec1b764d4a22872540b79f
  • alt-php74-process_7.4.33-70_amd64.deb
    sha:9d4bcc8a23c99c54f3e01d273e2c2fb22664f3ff
  • alt-php74-pspell_7.4.33-70_amd64.deb
    sha:ebb8a01b3d6828b2c566968452977c5144fc78c6
  • alt-php74-snmp_7.4.33-70_amd64.deb
    sha:acdcd6dff0583603d8e014e25d9a54a0d746331b
  • alt-php74-soap_7.4.33-70_amd64.deb
    sha:562c8ecb39ece92ab5ccd5657ebff1bf6d651eb5
  • alt-php74-sodium_7.4.33-70_amd64.deb
    sha:1a48aa2192fd5765cd95e896445c3e6cefa18766
  • alt-php74-tidy_7.4.33-70_amd64.deb
    sha:73361ad203e58a9e245321075db7e720bbf05ea2
  • alt-php74-xml_7.4.33-70_amd64.deb
    sha:f7ea05c228572d2c23da309083379889ad1539fb
  • alt-php74-xmlrpc_7.4.33-70_amd64.deb
    sha:9d27eb7a662350b0b9e48cb201e0f54fb72d5880
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.