[CLSA-2026:1792599451] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-21 16:34:17 UTC
Description:
* SECURITY UPDATE: code execution via state corruption after an out-of-memory error and via stale global state - debian/patches/CVE-2026-109618.patch: terminate the process on memory limit and allocation overflow errors instead of unwinding, clear request globals at shutdown, disable session upload progress, keep only the Content-Disposition and Content-Type multipart part headers and start request variable arrays with one slot. Also fix array_merge_recursive() duplicating integer keys (bug #76505): for hash sub-arrays it now appends after the largest integer key, as PHP 7.1.20 and later do. - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • libapache2-mod-php7.0_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:928afd5acec4c082b9a29756e95978a06acf210f
  • libphp7.0-embed_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:97f6157477088502a62e16074eb1254c8e3d9c2d
  • php7.0_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_all.deb
    sha:cf360c17d054b9fd7dd4eda0dabbf1f64c614e41
  • php7.0-bcmath_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:bdc7ff6e71a0ab0c86a7dfa15623be66b616a579
  • php7.0-bz2_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:90a820e306f4ae44033ff020118ba84e65d7b5c0
  • php7.0-cgi_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:87e3a13566535afee3c2dc3359b9ed853109df79
  • php7.0-cli_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:82fb88c2004f2e76d09bb50fa3643420c1d551ed
  • php7.0-common_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:f3c5af2bb0006f034313920cae53c28e305e18ae
  • php7.0-curl_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:93823555db70168ef150b391b6362c0a612b59dd
  • php7.0-dba_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:b101e0a2a50e81ff5464372ec8015c6f395c0c3a
  • php7.0-dev_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:43596560677f0eb97ed209424e396ac2520268d2
  • php7.0-enchant_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:a7122abd597b1600cb9ffa3e6d998dbc28a47262
  • php7.0-fpm_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:6fb8d2c9c8806431327b11a04f5c4ea678d575cc
  • php7.0-gd_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:c0d44a7934a4f1dcf0a91f613f875c7f44b5cff5
  • php7.0-gmp_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:5df62754af03c83a905185fefa10ad8e1021e0e7
  • php7.0-imap_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:f2a06b364af30a874cdb47b22c270b6f9a5895a5
  • php7.0-interbase_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:e54ba012c8da00075b20b491f8d0658953d8169c
  • php7.0-intl_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:d8ab79fce1de6d34dcc484c98b54144ad9cb0f99
  • php7.0-json_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:85a8ed9cfe535eef0543eaea2ffd1118c55de959
  • php7.0-ldap_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:3df2ac57e4f7a988c65d199f1632761a4a3905d4
  • php7.0-mbstring_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:46277f286a1eef471c58a2ba08fc3385c516cddb
  • php7.0-mcrypt_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:2703c0cb3d1c29e114c4ee78c8c42cb1a1ff66ec
  • php7.0-mysql_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:7984cf9f3d6554b1e61142d9691ce5bee78bf780
  • php7.0-odbc_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:67d3c05c4216caa4c112373525dddc420d6c1ad9
  • php7.0-opcache_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:4daf1167a157a88e21c3c21caae27ce5b0e33569
  • php7.0-pgsql_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:a3f1cb00b2842396fbdf217e4197d2b304a20a9c
  • php7.0-phpdbg_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:0492ef95f97ce961e0f9254db39bf07a3037efd6
  • php7.0-pspell_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:1dbc742458ac5fabebeb792b5b0391ac03d37248
  • php7.0-readline_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:60b12c9a5de3b4aabcbae95a2c72da3406f010a7
  • php7.0-recode_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:dccb5a2678717bf33ffb9eaf074d2b34b93640fe
  • php7.0-snmp_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:617e4f0ede3bd988371661cf02bb686e23bf45b7
  • php7.0-soap_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:c9b8d244fd61f01c54f9f7e5b783579e650bde6c
  • php7.0-sqlite3_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:71af6dcc48c361fb73ac418c8a022756144048c7
  • php7.0-sybase_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:3451f6dc5d1c13c33e6f0731d2d506d370957a4e
  • php7.0-tidy_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:ef5d12b773d366b348879fd4db1e00f81b513b46
  • php7.0-xml_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:af7ff2e9895e95d530c7bb70f22da2842fe4e92f
  • php7.0-xmlrpc_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:d73417d5c0533f9185240342ea3fd0f05462a8fa
  • php7.0-xsl_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_all.deb
    sha:98fff2c9e47b7215b8556ee54388200d70ae640a
  • php7.0-zip_7.0.33-0ubuntu0.16.04.17+tuxcare.els29_amd64.deb
    sha:3ebcb1dd6282278151988ef6bdc36a0a8517fb3e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.