[CLSA-2026:1791245612] Fix of 5 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-06 00:13:50 UTC
Description:
* SECURITY UPDATE: out-of-bounds read on an empty Location header in the http:// wrapper - debian/patches/php-7.3-CVE-2026-93682.patch: backport upstream commits 8196275133 and de3436c76e in ext/standard/http_fopen_wrapper.c - use header_info.location_len instead of strlen() and guard the relative redirect join with location_len > 1 so the byte after an empty Location value is never read (net effect of both commits). Adds the upstream http_empty_location_redirect.phpt and http_single_char_location_redirect.phpt tests, using this branch's ServerClientTestCase2.inc harness. - CVE-2026-93682 * SECURITY UPDATE: FastCGI listen.allowed_clients compared only 96 bits of IPv6 addresses - debian/patches/php-7.3-CVE-2026-91768.patch: backport upstream commit dcdfcf86fc in main/fastcgi.c - compare the full sizeof(sin6_addr) bytes of the client and allowed IPv6 addresses. - CVE-2026-91768
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-81_amd64.deb
    sha:94080c42e4d749ae4cebc04f7b95e032cbdc1077
  • alt-php73-bcmath_7.3.33-81_amd64.deb
    sha:a0fea18f58aaf175303bb144c6e044bc13f0d724
  • alt-php73-cli_7.3.33-81_amd64.deb
    sha:392d7a12b8c56998a42319f2d996bcff5c6e729c
  • alt-php73-common_7.3.33-81_amd64.deb
    sha:b1287ed79453f6bdc65ae42292b9773ed5387926
  • alt-php73-dba_7.3.33-81_amd64.deb
    sha:9f05a20ae8b2a7c5f841c61b78ba04b6cd9fc6bb
  • alt-php73-dev_7.3.33-81_amd64.deb
    sha:b83032f0048daa2535f026b2a4b6fd4e72ec4b5d
  • alt-php73-enchant_7.3.33-81_amd64.deb
    sha:5c6a5e09d06aded224e45480d7af52ec4f51fc26
  • alt-php73-firebird_7.3.33-81_amd64.deb
    sha:f0a9b2c2d90501394366b83e1ba3fd2eb9b9156b
  • alt-php73-gd_7.3.33-81_amd64.deb
    sha:d57723cf92009e07d6192becf09256890b3716ec
  • alt-php73-imap_7.3.33-81_amd64.deb
    sha:2df013849453d8029eb3a4b91b443fe1f061afdb
  • alt-php73-intl_7.3.33-81_amd64.deb
    sha:9b9f791426623e5a7de6452653e020f6652092d5
  • alt-php73-ldap_7.3.33-81_amd64.deb
    sha:909af900d1cca4fc3056de77a4e6431f8ce66d8b
  • alt-php73-mbstring_7.3.33-81_amd64.deb
    sha:09ec77f3e60c0c59ec612b0e7fc9bf6d0147be25
  • alt-php73-mysqlnd_7.3.33-81_amd64.deb
    sha:143bb30a7345787665ee8732b47c876e49c42464
  • alt-php73-odbc_7.3.33-81_amd64.deb
    sha:3dc108ceff99e095d171f48f216de29984ee05df
  • alt-php73-opcache_7.3.33-81_amd64.deb
    sha:194742bf24e85b7671b2781fa8e08cc684892a4f
  • alt-php73-pdo_7.3.33-81_amd64.deb
    sha:7c8abeef3749e4e58583076e2462ba54dbfe9edd
  • alt-php73-pgsql_7.3.33-81_amd64.deb
    sha:cfece2ef209586387dec1924d91af0593a9ded4e
  • alt-php73-php-fpm_7.3.33-81_amd64.deb
    sha:5cce5628d979aaee1c3dd2b15e1670838735319f
  • alt-php73-process_7.3.33-81_amd64.deb
    sha:04f3c6d98a36f1089fed5ec1fdfc70320f3fc97c
  • alt-php73-pspell_7.3.33-81_amd64.deb
    sha:982eff72e12999a3d3baa160273ede5116f233e1
  • alt-php73-recode_7.3.33-81_amd64.deb
    sha:35646386f36e15607110a1a79f27c1dfebfb5cd5
  • alt-php73-snmp_7.3.33-81_amd64.deb
    sha:c565f362b52053df08834a5ca9c6799b596a90e3
  • alt-php73-soap_7.3.33-81_amd64.deb
    sha:3178d1dd60d6a70061f61551b52175ab5bc19878
  • alt-php73-sodium_7.3.33-81_amd64.deb
    sha:506378034f8f2287a0cedadefbe449486c47f060
  • alt-php73-tidy_7.3.33-81_amd64.deb
    sha:bd3a445acba9716b638d3c34b0c3090922bbc45f
  • alt-php73-xml_7.3.33-81_amd64.deb
    sha:5b8cc2b68bc4ffdac6e22bd881ad6c8f1d131b18
  • alt-php73-xmlrpc_7.3.33-81_amd64.deb
    sha:02efae9e4da3d84fa958c42ec91722034958923c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.