[CLSA-2026:1791190970] Fix of 5 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-05 09:03:07 UTC
Description:
* SECURITY UPDATE: out-of-bounds read on an empty Location header in the http:// wrapper - debian/patches/php-7.3-CVE-2026-93682.patch: backport upstream commits 8196275133 and de3436c76e in ext/standard/http_fopen_wrapper.c - use header_info.location_len instead of strlen() and guard the relative redirect join with location_len > 1 so the byte after an empty Location value is never read (net effect of both commits). Adds the upstream http_empty_location_redirect.phpt and http_single_char_location_redirect.phpt tests, using this branch's ServerClientTestCase2.inc harness. - CVE-2026-93682 * SECURITY UPDATE: FastCGI listen.allowed_clients compared only 96 bits of IPv6 addresses - debian/patches/php-7.3-CVE-2026-91768.patch: backport upstream commit dcdfcf86fc in main/fastcgi.c - compare the full sizeof(sin6_addr) bytes of the client and allowed IPv6 addresses. - CVE-2026-91768
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-81_amd64.deb
    sha:94080c42e4d749ae4cebc04f7b95e032cbdc1077
  • alt-php73-bcmath_7.3.33-81_amd64.deb
    sha:c3ba5a3c8b311ebf1d47c52374c7bd7676b2800e
  • alt-php73-cli_7.3.33-81_amd64.deb
    sha:f46275a2db85c89dbfc8339a8f23ca32742408a1
  • alt-php73-common_7.3.33-81_amd64.deb
    sha:9c998d006e2869a6fcdcd00d829614f66ebe110a
  • alt-php73-dba_7.3.33-81_amd64.deb
    sha:1dc0f9ae598ec25516fb3dde99301cd5b58a752d
  • alt-php73-dev_7.3.33-81_amd64.deb
    sha:7575efab33851d1a2872d55439e384c2a5eaf96d
  • alt-php73-enchant_7.3.33-81_amd64.deb
    sha:925cefa4bffe4eb8f9e2d429a6f93ec96f9cbbf5
  • alt-php73-firebird_7.3.33-81_amd64.deb
    sha:84ba785eb0e486fefdff66b18968ee58d347a8d8
  • alt-php73-gd_7.3.33-81_amd64.deb
    sha:1ff3e8c267b71ca8be03bbf9ad9bc708a6f1f05b
  • alt-php73-imap_7.3.33-81_amd64.deb
    sha:b35bb2ade11d9766089697be9cc4330a1cade90e
  • alt-php73-intl_7.3.33-81_amd64.deb
    sha:378601d6549635de29a63758d786009897cfded2
  • alt-php73-ldap_7.3.33-81_amd64.deb
    sha:882fa8340525b0fa065d1cc6c330a3c53b6cdf6a
  • alt-php73-mbstring_7.3.33-81_amd64.deb
    sha:f8923258e4802ad69c018fadb47f3bd0bf2f600f
  • alt-php73-mysqlnd_7.3.33-81_amd64.deb
    sha:829dd073c478a8e87af9465700ddaf73c448d258
  • alt-php73-odbc_7.3.33-81_amd64.deb
    sha:9f6cbb0382d3ac66ab0f601af7357c4b9736bfdc
  • alt-php73-opcache_7.3.33-81_amd64.deb
    sha:5fe73e067f764a1ab074be6d8450d2cc455f7102
  • alt-php73-pdo_7.3.33-81_amd64.deb
    sha:dc63ebb667222be2ec7e0f6b5ecc07809667c319
  • alt-php73-pgsql_7.3.33-81_amd64.deb
    sha:ab865b7d3b50176af1e4d0ffdc2b08c761ae03d8
  • alt-php73-php-fpm_7.3.33-81_amd64.deb
    sha:41706c0e62fae464e5db7b5fde95473c34f07aa7
  • alt-php73-process_7.3.33-81_amd64.deb
    sha:f66d5011da9706169e75001b775114ebddff95d1
  • alt-php73-pspell_7.3.33-81_amd64.deb
    sha:cf0deb523cc9e206b1d117d45a6f1a6753dd49fb
  • alt-php73-recode_7.3.33-81_amd64.deb
    sha:0a6764d559bb10eba383a99dbcc02842b0979af6
  • alt-php73-snmp_7.3.33-81_amd64.deb
    sha:511b702789986bd3dcf21e590f9f129047064498
  • alt-php73-soap_7.3.33-81_amd64.deb
    sha:0a7cf950bf641788d4342a3ba352627112ae4b6d
  • alt-php73-sodium_7.3.33-81_amd64.deb
    sha:0a1f4b92d2f8be7437664a6390fb70533743aa1f
  • alt-php73-tidy_7.3.33-81_amd64.deb
    sha:12d3364306d9b84c7abe56ee0dc9bec55b4fa1cf
  • alt-php73-xml_7.3.33-81_amd64.deb
    sha:22df73baa75ff7c46bd01b6d8823803e075d5088
  • alt-php73-xmlrpc_7.3.33-81_amd64.deb
    sha:cbccf5a84fbc9eb7579c268d0fc374ec47e41dd4
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.