[CLSA-2026:1791261512] Fix of 5 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-06 04:38:47 UTC
Description:
* SECURITY UPDATE: out-of-bounds read on an empty HTTP Location header - debian/patches/php-8.1-CVE-2026-93682.patch: use location_len instead of strlen() and of reading location[1] when deciding how to resolve a relative redirect, so an empty Location value no longer over-reads the one-byte buffer, in ext/standard/http_fopen_wrapper.c. - CVE-2026-93682 * SECURITY UPDATE: FastCGI allowed_clients IPv6 check matches only 96 bits - debian/patches/php-8.1-CVE-2026-91768.patch: compare the full sin6_addr instead of its first 12 bytes when matching an IPv6 client against listen.allowed_clients in main/fastcgi.c. - CVE-2026-91768
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-36_amd64.deb
    sha:4efd48f50e26f5030e1cec6422ad7877f3751f52
  • alt-php81-bcmath_8.1.34-36_amd64.deb
    sha:97bbc716e6b67ca05195ced415f3b0140e621c18
  • alt-php81-cli_8.1.34-36_amd64.deb
    sha:e409393f273f1025c98980835853feb17849efe6
  • alt-php81-common_8.1.34-36_amd64.deb
    sha:ae2072e964f47882767e7f65a360f3b463095d6c
  • alt-php81-dba_8.1.34-36_amd64.deb
    sha:b6db0735549d834c297586c4477bdc6c6a765180
  • alt-php81-dev_8.1.34-36_amd64.deb
    sha:20289e57683ab3a2080a7308f4315bb95edce078
  • alt-php81-enchant_8.1.34-36_amd64.deb
    sha:01efaa00363a32113a8a0886bb6c819a34ceda71
  • alt-php81-firebird_8.1.34-36_amd64.deb
    sha:3414b4a8dc6d36be4fae85707dd771e14c4601d0
  • alt-php81-gd_8.1.34-36_amd64.deb
    sha:8d8c314c91fea92789cdca7cb20dddd886393c0b
  • alt-php81-imap_8.1.34-36_amd64.deb
    sha:4ee9ca39fec336ee0928e19714ce63c45478ee52
  • alt-php81-intl_8.1.34-36_amd64.deb
    sha:c2f28cf5a31ded15b9fa0cfea19ce2f454195acb
  • alt-php81-ldap_8.1.34-36_amd64.deb
    sha:fa34604c494834e57fbd0d69212535531d2637d9
  • alt-php81-mbstring_8.1.34-36_amd64.deb
    sha:cec6d04fb423e9e426dbdb6089462dd6bc7f27fe
  • alt-php81-mysqlnd_8.1.34-36_amd64.deb
    sha:91cce0e4c32d5d93779dcc5d5dcd3162744eaf14
  • alt-php81-odbc_8.1.34-36_amd64.deb
    sha:919660ea099629137bc36d3c7ded061a93431332
  • alt-php81-opcache_8.1.34-36_amd64.deb
    sha:a745a1be0829128a386f90d4c772a7f2d4fed18d
  • alt-php81-pdo_8.1.34-36_amd64.deb
    sha:ca022c0ee5733f223c1ab3e9a126829f5b3873d4
  • alt-php81-pgsql_8.1.34-36_amd64.deb
    sha:89f8e68e0fb5b5afcf8ef663048711e689282f89
  • alt-php81-php-fpm_8.1.34-36_amd64.deb
    sha:4285a0fe4d4fece637bc068b79eae93993475dd7
  • alt-php81-process_8.1.34-36_amd64.deb
    sha:6229ae6f6018ee218dcc3e392ed2af58c2a963ca
  • alt-php81-pspell_8.1.34-36_amd64.deb
    sha:daaf408b43eb1aa313da322449ce3503d87d5033
  • alt-php81-snmp_8.1.34-36_amd64.deb
    sha:f3547acc721f4cc74731e5d2c4d80cc3bada8a77
  • alt-php81-soap_8.1.34-36_amd64.deb
    sha:6484f9ef05204738874082f39ade89fa860135db
  • alt-php81-sodium_8.1.34-36_amd64.deb
    sha:750bf10f18761f49a5edb1dab61577630755688e
  • alt-php81-tidy_8.1.34-36_amd64.deb
    sha:04bcb1304d35feca9d097406ccdbca2920534463
  • alt-php81-xml_8.1.34-36_amd64.deb
    sha:a18243b4248e9a0cd928dfe63315f0448ba8ffc9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.