[CLSA-2026:1791202083] Fix of 5 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-05 12:08:20 UTC
Description:
* SECURITY UPDATE: out-of-bounds read on an empty Location header in the http:// wrapper redirect handling - debian/patches/php-7.4-CVE-2026-93682.patch: backport upstream commits 8196275133 and de3436c76e in ext/standard/http_fopen_wrapper.c - use header_info.location_len instead of strlen() and of reading the second byte of the Location value, and only join a relative Location against the request path when it is longer than one character. - CVE-2026-93682 * SECURITY UPDATE: FastCGI listen.allowed_clients compared only the first 96 bits of IPv6 addresses - debian/patches/php-7.4-CVE-2026-91768.patch: backport upstream commit dcdfcf86fc in main/fastcgi.c - compare the full sin6_addr in fcgi_is_allowed(). Carries upstream's two FPM allowed_clients tests, adapted to the 7.4 LogTool regex syntax. - CVE-2026-91768
CVEs fixed:
Updated packages:
  • alt-php74_7.4.33-78_amd64.deb
    sha:eaa19c37439f81f4dca3aa22b0fc688cb82803c9
  • alt-php74-bcmath_7.4.33-78_amd64.deb
    sha:feb0306a90b114e9a9c9ae90fd26a6c418953601
  • alt-php74-cli_7.4.33-78_amd64.deb
    sha:174788da204889aeb36f708d201d9e01dea48498
  • alt-php74-common_7.4.33-78_amd64.deb
    sha:df4bd66644141207118a99c03d3ee4f9a581a792
  • alt-php74-dba_7.4.33-78_amd64.deb
    sha:9ce2f8f3bb56ee404e945b4b38d6525ca2aa8156
  • alt-php74-dev_7.4.33-78_amd64.deb
    sha:26fe1e237ff66868eebeca2afc4835347a21cd22
  • alt-php74-enchant_7.4.33-78_amd64.deb
    sha:9e2aa63422ef5613916ac911faefd0c91d4b991c
  • alt-php74-firebird_7.4.33-78_amd64.deb
    sha:ebb1b8611ad1235fc153e20c982a65e61f79c8e0
  • alt-php74-gd_7.4.33-78_amd64.deb
    sha:891840e3be2d8fe6f52238600eaaa6fdb6f4064e
  • alt-php74-imap_7.4.33-78_amd64.deb
    sha:de4764d71079b9fada41bd5adc44c08f2e96b1ce
  • alt-php74-intl_7.4.33-78_amd64.deb
    sha:05531ba3ffea58e8d3176a66cda30b5bb4c57e62
  • alt-php74-ldap_7.4.33-78_amd64.deb
    sha:17ae8351b2419a48f7bb1aa2e0ef571255aa170b
  • alt-php74-mbstring_7.4.33-78_amd64.deb
    sha:8dc50aef6bcb62876faa2160bcc1ae41436af885
  • alt-php74-mysqlnd_7.4.33-78_amd64.deb
    sha:836858e21dcf7e67806984898ee364631c32e5e6
  • alt-php74-odbc_7.4.33-78_amd64.deb
    sha:c22b29f3c5ac2592efeff98c5fa4734b7857d56c
  • alt-php74-opcache_7.4.33-78_amd64.deb
    sha:41af7cf4c5105ae57088921f1a0cf46d1c77f4eb
  • alt-php74-pdo_7.4.33-78_amd64.deb
    sha:e53bd1ae540aa2cda8cf1c76b04cc73c2923080c
  • alt-php74-pgsql_7.4.33-78_amd64.deb
    sha:f5ee154609cadfd5cd25f76eb2624f454309b780
  • alt-php74-php-fpm_7.4.33-78_amd64.deb
    sha:ac0b9e46a0fbfa8ea7352ef1c5e4455f99a45382
  • alt-php74-process_7.4.33-78_amd64.deb
    sha:402f31a3d68383a1d2331e0e6b46e671d82a50a9
  • alt-php74-pspell_7.4.33-78_amd64.deb
    sha:4887624d14c261a93ec6b560911aafd76ca6b409
  • alt-php74-snmp_7.4.33-78_amd64.deb
    sha:e68650e1134dfbfc497da4de3616be4c7b92b368
  • alt-php74-soap_7.4.33-78_amd64.deb
    sha:5ee0db4666c0ef100e3f78f2f89789247c45e11f
  • alt-php74-sodium_7.4.33-78_amd64.deb
    sha:caf5df9b8a72cdd30256ba8bb21e5cf89ccc8144
  • alt-php74-tidy_7.4.33-78_amd64.deb
    sha:b0e4ad8acbfc7bc226aba4cdc8ba5de9d8d5b589
  • alt-php74-xml_7.4.33-78_amd64.deb
    sha:1a8fd9dee06a98aa1427e045342ed2e88b488eb5
  • alt-php74-xmlrpc_7.4.33-78_amd64.deb
    sha:ad6886127d5419a4b2985a17823718d8dc4c9119
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.