[CLSA-2026:1791259237] Fix of 5 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-06 04:00:56 UTC
Description:
* SECURITY UPDATE: out-of-bounds read on an empty HTTP Location header - debian/patches/php-8.1-CVE-2026-93682.patch: use location_len instead of strlen() and of reading location[1] when deciding how to resolve a relative redirect, so an empty Location value no longer over-reads the one-byte buffer, in ext/standard/http_fopen_wrapper.c. - CVE-2026-93682 * SECURITY UPDATE: FastCGI allowed_clients IPv6 check matches only 96 bits - debian/patches/php-8.1-CVE-2026-91768.patch: compare the full sin6_addr instead of its first 12 bytes when matching an IPv6 client against listen.allowed_clients in main/fastcgi.c. - CVE-2026-91768
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-36_amd64.deb
    sha:4efd48f50e26f5030e1cec6422ad7877f3751f52
  • alt-php81-bcmath_8.1.34-36_amd64.deb
    sha:6c9bdcb5703660d2115ba68041f4bbb4df9fcd94
  • alt-php81-cli_8.1.34-36_amd64.deb
    sha:5d28f0f44757c9deb934d628ca546d59f646c80e
  • alt-php81-common_8.1.34-36_amd64.deb
    sha:870a87b33ed24b5f211bb0c540355f80494eb036
  • alt-php81-dba_8.1.34-36_amd64.deb
    sha:017d508b0a8e56e6dfe4be93623f10c2f87aa65b
  • alt-php81-dev_8.1.34-36_amd64.deb
    sha:80f65f66c721015af308dd997a2b08bc69e8f1ab
  • alt-php81-enchant_8.1.34-36_amd64.deb
    sha:6cc948569de8d4b46d48ac0e72acc124a7631899
  • alt-php81-firebird_8.1.34-36_amd64.deb
    sha:247a3bf27e867dc4ebef23861758d9a87bc49cc0
  • alt-php81-gd_8.1.34-36_amd64.deb
    sha:5fa9b2ab6ab845b78eadc7a7b87af01d7444d9b4
  • alt-php81-imap_8.1.34-36_amd64.deb
    sha:d6a6b143497bba15f79a6d0a1a8dd25ac79f06a5
  • alt-php81-intl_8.1.34-36_amd64.deb
    sha:f2e76bb6573d06027aa145860b124eb29496676a
  • alt-php81-ldap_8.1.34-36_amd64.deb
    sha:0397f48019b0a902c4a1629208ae36d737130e39
  • alt-php81-mbstring_8.1.34-36_amd64.deb
    sha:2f502565f25e22553a7a8e258a813723b352eafb
  • alt-php81-mysqlnd_8.1.34-36_amd64.deb
    sha:3af5f991b73d9566c6f32ca7f9503f3c4ab2c48f
  • alt-php81-odbc_8.1.34-36_amd64.deb
    sha:65593fe56aa74deae775d2bb2ce81cd548f61987
  • alt-php81-opcache_8.1.34-36_amd64.deb
    sha:fbea0677839edde574670773ac6419877064f28c
  • alt-php81-pdo_8.1.34-36_amd64.deb
    sha:64165a05e73d8979aae9b6e7168fc49b9babc868
  • alt-php81-pgsql_8.1.34-36_amd64.deb
    sha:5f39ac1fb062151a90003c93c600793f3898289e
  • alt-php81-php-fpm_8.1.34-36_amd64.deb
    sha:11c65f36a8db94846fc3108977ee58edf344d70c
  • alt-php81-process_8.1.34-36_amd64.deb
    sha:db500b73cab53836559211dd68d630185a2966b5
  • alt-php81-pspell_8.1.34-36_amd64.deb
    sha:5f93b64d78cfc37715699165c9ff0b6ab0a37485
  • alt-php81-snmp_8.1.34-36_amd64.deb
    sha:d4be26c528bb2f57efd340b7492c9ff70ab86d67
  • alt-php81-soap_8.1.34-36_amd64.deb
    sha:0cb9d09b5b8cc2a528d4a5c5225c4b678c6f5671
  • alt-php81-sodium_8.1.34-36_amd64.deb
    sha:6b20588d12290dc3c7e91cfaa9c17cd2681ddd56
  • alt-php81-tidy_8.1.34-36_amd64.deb
    sha:d0d512dfb6b29f4e6702b60197111e0c1fcb20d7
  • alt-php81-xml_8.1.34-36_amd64.deb
    sha:c1a64f00c8ffcab7426c51b3bd5f1c0fb1a5f625
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.