[CLSA-2026:1791241850] Fix of 5 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-05 23:11:04 UTC
Description:
* SECURITY UPDATE: out-of-bounds read on an empty Location header in the http:// wrapper redirect handling - debian/patches/php-7.4-CVE-2026-93682.patch: backport upstream commits 8196275133 and de3436c76e in ext/standard/http_fopen_wrapper.c - use header_info.location_len instead of strlen() and of reading the second byte of the Location value, and only join a relative Location against the request path when it is longer than one character. - CVE-2026-93682 * SECURITY UPDATE: FastCGI listen.allowed_clients compared only the first 96 bits of IPv6 addresses - debian/patches/php-7.4-CVE-2026-91768.patch: backport upstream commit dcdfcf86fc in main/fastcgi.c - compare the full sin6_addr in fcgi_is_allowed(). Carries upstream's two FPM allowed_clients tests, adapted to the 7.4 LogTool regex syntax. - CVE-2026-91768
CVEs fixed:
Updated packages:
  • alt-php74_7.4.33-78_amd64.deb
    sha:eaa19c37439f81f4dca3aa22b0fc688cb82803c9
  • alt-php74-bcmath_7.4.33-78_amd64.deb
    sha:4bb433b3a4f926077569d528696b08d1416a31c3
  • alt-php74-cli_7.4.33-78_amd64.deb
    sha:e6f1da8bdec385dea72bbf0100c6de146ef02285
  • alt-php74-common_7.4.33-78_amd64.deb
    sha:9d3ae57e1be50df2dc1bcb2e84e0147909877575
  • alt-php74-dba_7.4.33-78_amd64.deb
    sha:9f9cde7091ef825128f467059b7043cdd4d17440
  • alt-php74-dev_7.4.33-78_amd64.deb
    sha:deabab97bba9ac361591cc01bea5cdd5ee8d393f
  • alt-php74-enchant_7.4.33-78_amd64.deb
    sha:5cc6400ad1f70f7a0e077743f2d7ba21c0ec08a2
  • alt-php74-firebird_7.4.33-78_amd64.deb
    sha:413c931fa2a967514c03b64baabd698ed0287ed9
  • alt-php74-gd_7.4.33-78_amd64.deb
    sha:ef73586624dc28699b3d2a609e158a093f7f66dc
  • alt-php74-imap_7.4.33-78_amd64.deb
    sha:ec51a8246c6a2b55ebdae0e642076f614918d314
  • alt-php74-intl_7.4.33-78_amd64.deb
    sha:a70937f51783673a41451dae2503b264c1320716
  • alt-php74-ldap_7.4.33-78_amd64.deb
    sha:60ddd144b0c80b6db5f57fdbfcabeb04cfcea573
  • alt-php74-mbstring_7.4.33-78_amd64.deb
    sha:55b43e9bf6378900f32dc74bb8ea4ef73c5aacce
  • alt-php74-mysqlnd_7.4.33-78_amd64.deb
    sha:35bee3a4c1ac106c4932e8f072bdc5f91f73daf2
  • alt-php74-odbc_7.4.33-78_amd64.deb
    sha:ce4e9a585d2ec59bb343cb4552ac500d445bdd1c
  • alt-php74-opcache_7.4.33-78_amd64.deb
    sha:ccf02eba5df466d66a9b183b8d9375d4ee44c00c
  • alt-php74-pdo_7.4.33-78_amd64.deb
    sha:6ff7289b9032447788ee5fc847b922a8b581386f
  • alt-php74-pgsql_7.4.33-78_amd64.deb
    sha:67dddfc3f6947c1691a35a553992395d9da07b55
  • alt-php74-php-fpm_7.4.33-78_amd64.deb
    sha:174d091acffee44673e155454cf982faaf3829c8
  • alt-php74-process_7.4.33-78_amd64.deb
    sha:d78afd8a052db6be4c1e4aec2e0debf3f383b72c
  • alt-php74-pspell_7.4.33-78_amd64.deb
    sha:cde23d8211984681e2b33bdc6c0f171528e2165d
  • alt-php74-snmp_7.4.33-78_amd64.deb
    sha:3ea1b531067c30f92a96a980e39c97d7b8bc73de
  • alt-php74-soap_7.4.33-78_amd64.deb
    sha:d7c0acdd7aa3dc74bc3d89dd2302acc5e338b0ef
  • alt-php74-sodium_7.4.33-78_amd64.deb
    sha:cdc7ee6f3c5d76fc9caa282a769a2cfb6bc4fe04
  • alt-php74-tidy_7.4.33-78_amd64.deb
    sha:d6616b40413e6870bab95aa0c4eecfc2a1efae94
  • alt-php74-xml_7.4.33-78_amd64.deb
    sha:a08a6a325a2b7887eda3c7ba1f8695b6f5b59169
  • alt-php74-xmlrpc_7.4.33-78_amd64.deb
    sha:9e9065ea09a03f7eba2f2dc5733d4a35f58d08b8
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.