[CLSA-2026:1786394829] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-10 20:47:31 UTC
Description:
* CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an end-of-stream code * CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-74_amd64.deb
    sha:5291a84b3557d9ee528757e0ff1b4a59c7915aae
  • alt-php73-bcmath_7.3.33-74_amd64.deb
    sha:763a9132163b25d7f89605a5474b70beb1c4530d
  • alt-php73-cli_7.3.33-74_amd64.deb
    sha:d6c68a3a1de522e2bc24c17bc075b569bf6722da
  • alt-php73-common_7.3.33-74_amd64.deb
    sha:013003060ae708fcea3d77c90900273fdde82748
  • alt-php73-dba_7.3.33-74_amd64.deb
    sha:7456986476d8db79de071896bac1075d1164609f
  • alt-php73-dev_7.3.33-74_amd64.deb
    sha:70108c27d5bf627a26f8b7a503e6b4500598f923
  • alt-php73-enchant_7.3.33-74_amd64.deb
    sha:caa3b7d5dbbdab3b60941a924d1080d1e2eebf5c
  • alt-php73-firebird_7.3.33-74_amd64.deb
    sha:59954f08e3bff3fdcfc671af3947d9d8822e4d80
  • alt-php73-gd_7.3.33-74_amd64.deb
    sha:6a1607d78b5010f129c72bd13892198283304114
  • alt-php73-imap_7.3.33-74_amd64.deb
    sha:a8a618fd31aa182b380ae0003930565c7125d416
  • alt-php73-intl_7.3.33-74_amd64.deb
    sha:ac946d56ae6b08dbb1d8e5611b4d8ff1ab498d2c
  • alt-php73-ldap_7.3.33-74_amd64.deb
    sha:dc706de63e6c0f339ee47da6329c75dda1d8629a
  • alt-php73-mbstring_7.3.33-74_amd64.deb
    sha:d6a4e9b1152492e77ac951f05993d25f8e7fc2ac
  • alt-php73-mysqlnd_7.3.33-74_amd64.deb
    sha:db6c36ac98ecfb0fe9281b62fb2b3a228b511d02
  • alt-php73-odbc_7.3.33-74_amd64.deb
    sha:273773e2ef672c7fa79679df8aa187ea921e4959
  • alt-php73-opcache_7.3.33-74_amd64.deb
    sha:665e499ec465a1e644c51c8db0c2d58cb2c8a3bf
  • alt-php73-pdo_7.3.33-74_amd64.deb
    sha:5f2f61674beb27b82d6bc8a8a3185f014dc291c4
  • alt-php73-pgsql_7.3.33-74_amd64.deb
    sha:d0bb8330376e7d1a04ebdb10c57e6b06583411e0
  • alt-php73-php-fpm_7.3.33-74_amd64.deb
    sha:65cf5ced3cfa32f5a32a9785203c74e3ee6dff07
  • alt-php73-process_7.3.33-74_amd64.deb
    sha:662ccbaff92880c69da8fb4838b9d19905232c62
  • alt-php73-pspell_7.3.33-74_amd64.deb
    sha:e379c723a58d23fee8d7cc258b27ccd42fa3b0a0
  • alt-php73-recode_7.3.33-74_amd64.deb
    sha:6d5a4feb02a4be796c1eddbf274c36a50aa0b35a
  • alt-php73-snmp_7.3.33-74_amd64.deb
    sha:43bebd77084adb4e7124ad4b1c4ae854ddfd1fd6
  • alt-php73-soap_7.3.33-74_amd64.deb
    sha:1b90721d26f1954471019e373bd6bab124bc2bb3
  • alt-php73-sodium_7.3.33-74_amd64.deb
    sha:a2545d4f783f653372537080b7ed3ce490cec5c7
  • alt-php73-tidy_7.3.33-74_amd64.deb
    sha:1f172432bb67318c8a532c8c138f2c98091e2157
  • alt-php73-xml_7.3.33-74_amd64.deb
    sha:34eaf1e582b3ef8376b297544330579d4ec7ad58
  • alt-php73-xmlrpc_7.3.33-74_amd64.deb
    sha:3dba08e1049a8db44c827442f71ad85d50f68e47
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.