[CLSA-2026:1791531340] Fix of 10 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-09 07:36:03 UTC
Description:
* SECURITY UPDATE: credentials leaked to another origin on HTTP redirects - debian/patches/CVE-2026-91766.patch: strip the Authorization, Cookie and Proxy-Authorization user headers when a redirect changes the scheme, host or port, and remove whole header lines in ext/standard/http_fopen_wrapper.c - CVE-2026-91766 * SECURITY UPDATE: heap over-read in TLS wildcard certificate name matching - debian/patches/CVE-2026-91767.patch: include the wildcard prefix length in the subject length check so memchr() cannot read past the peer name in ext/openssl/xp_ssl.c - CVE-2026-91767 * SECURITY UPDATE: FastCGI allowed_clients matched IPv6 clients on a /96 prefix - debian/patches/CVE-2026-91768.patch: compare the full 16-byte IPv6 address in fcgi_is_allowed() in main/fastcgi.c - CVE-2026-91768 * SECURITY UPDATE: TLS peer name check fell back to the certificate CN when the certificate has a service identity - debian/patches/CVE-2026-91769.patch: do not fall back to the Common Name when the certificate has a DNS, URI or SRV subjectAltName in ext/openssl/xp_ssl.c - CVE-2026-91769 * SECURITY UPDATE: heap over-read on an empty Location header in HTTP redirects - debian/patches/CVE-2026-93682.patch: use the stored Location length instead of strlen() and of reading the second byte when resolving a relative redirect in ext/standard/http_fopen_wrapper.c - CVE-2026-93682
CVEs fixed:
Updated packages:
  • libapache2-mod-php7.4_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:93eab948d4ebbcd99f65874fb6122eda251bd050
  • libphp7.4-embed_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:29a7b55c937ef9e048efd999f57e17cd35caca45
  • php7.4_7.4.3-4ubuntu2.29+tuxcare.els9_all.deb
    sha:60831f4365e6c9684c9ff840d61bc8a093fdf6dc
  • php7.4-bcmath_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:36d1922b828fd3d98e89912d29ad48cd7e1c98e2
  • php7.4-bz2_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:2a53ee8ebce969999560728326d9e09437d2aa0d
  • php7.4-cgi_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:dfe5657c6f5622e162326c6515bee00c927404e7
  • php7.4-cli_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:faaeaa09d25dc421659f2d3030058fd7e06e1441
  • php7.4-common_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:8a09b3d52bcd6a69dd7108fc5e0b28404e48072b
  • php7.4-curl_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:89c932db79ec57574dd4f57bdcd381ce70d3ac07
  • php7.4-dba_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:f96bdb7c2dd71e02dc99d88ace577806be258f8a
  • php7.4-dev_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:9be8199e158010e2cca841f01f1a61d81391140e
  • php7.4-enchant_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:f44c30181e7ea8864f69c398b49cbd9ec467e080
  • php7.4-fpm_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:d99f4ffc0f497c2666acf0838765bb0a2b006958
  • php7.4-gd_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:7733c98e7d29c5bd9e78be60b31da0b703c8061a
  • php7.4-gmp_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:e8773630f77ac6af34aed1578d9b91ac10cbab60
  • php7.4-imap_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:219dfcc30d1fbdad6965b91d12865aa700844a3e
  • php7.4-interbase_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:8bb8935415f76220b77cc471015f0f8e24f0f367
  • php7.4-intl_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:319f9aa91a44f82cb37ace5095d80a545e236601
  • php7.4-json_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:8ea2bbe5b942f004a257a645154733a685a9ae67
  • php7.4-ldap_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:5467f835daa7a5c3ea639fcf8e0e3e2a1d7fcac3
  • php7.4-mbstring_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:c5adc1f8bcd2eb6755043093ec5a87edfedc6443
  • php7.4-mysql_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:4a21c396eadce1a8add9c5a1ed18ac9a7c353a06
  • php7.4-odbc_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:8f6ab26f28f3b1be45c94738075fbb2686812690
  • php7.4-opcache_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:d7b7a73c9c1e75977d8661236d84ad4c9e546520
  • php7.4-pgsql_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:72930eee4f99b0b2f2e96e25fb75259be87092d5
  • php7.4-phpdbg_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:ce2de6bb2fe05889dc84844b9dce9018179a8e91
  • php7.4-pspell_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:3537bbe230821a1cdc86d291e5e13031ffeb1115
  • php7.4-readline_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:b76b644616346156e21d65bcea59667b8b38f46b
  • php7.4-snmp_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:2ab5ba9fa6c3592fbd0ac4f06afd3d618443e684
  • php7.4-soap_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:2902410d14dc153f26277ddb1c9735788b505db9
  • php7.4-sqlite3_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:1f84fe829319a6595432297f2bf43ff4a268c6de
  • php7.4-sybase_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:a2bfd89693588f0cf5635d7ee5f496d6264f53a4
  • php7.4-tidy_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:8a09c02a1253c41177cb53a264265c90bb1fe1f4
  • php7.4-xml_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:6c2648019f9c38607cc6a5c246cd480feed37252
  • php7.4-xmlrpc_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:c13254db7b78dbf9698e01c378a189f94d526b8c
  • php7.4-xsl_7.4.3-4ubuntu2.29+tuxcare.els9_all.deb
    sha:8bce36d2de54cd0c5ce83148880c3fbda148b0f5
  • php7.4-zip_7.4.3-4ubuntu2.29+tuxcare.els9_amd64.deb
    sha:5771a6b2656cded42b7695ff6bb9301bf0b08c07
  • libapache2-mod-php7.4_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:36d0ea81ca7d2bc2f9ea8f73a28d0adf650bb4c6
  • libphp7.4-embed_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:2ab6816bc88f0a91256480bc1668909b58fdf127
  • php7.4-bcmath_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:003eb2fc0108ece35bdfbafed76309b05ad1889c
  • php7.4-bz2_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:1b5167676a7501334fdb28a604bbfd0fc8f8a079
  • php7.4-cgi_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:062052aaf85c8bd5ccbe8570af704264bed29ac3
  • php7.4-cli_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:9ddc6fcc0b3393e81ea2d6701e6d59b86b952ca2
  • php7.4-common_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:80ee928fedd9e8a27fdea7b585fdab6eedd6c5ea
  • php7.4-curl_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:88fa6b8c1ef29442b8eac3ffc5a1d5b312854659
  • php7.4-dba_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:f7622fd13e0d21dfe91468424820c33b5cf3bf26
  • php7.4-dev_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:113fa1cf99f4a7d3ae89c0241cb2a4be18ed7a12
  • php7.4-enchant_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:de8b554c4027e581634164576e27fe83d6cdbb9e
  • php7.4-fpm_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:03b65e1fdc0b74f81b397724a6456e370fab0021
  • php7.4-gd_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:0e9896aa7fd4d2860b8eb25f09ac5aefd5bf2c2f
  • php7.4-gmp_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:67eed3e68af2e351a19756ec0abdd1b22444f597
  • php7.4-imap_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:100269e78ae576ad0e8a85d33994e62548773dda
  • php7.4-interbase_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:a6e7f629167284e3444c9ee8da620d24f19ee2c8
  • php7.4-intl_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:a317ffe3177edbc19aa8f2966fc7e15009cfd462
  • php7.4-json_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:90b3c564a8a635e94446be37c2df5380d2c1cdfe
  • php7.4-ldap_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:a0680a2113f150b373676cd8afeb447c57a9d418
  • php7.4-mbstring_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:636eb6614cc92fdaa595adaea10728842253f83c
  • php7.4-mysql_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:a08f741082afa49a4cb6212c5da6a5dae05cf238
  • php7.4-odbc_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:830c6f5e0e6de18f0e1fc541fb7045e8d224f5c5
  • php7.4-opcache_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:f7070e688b60f17e35fc2a7856164c51c2cdad55
  • php7.4-pgsql_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:66ec7f3a7539889d45ce88b75b3e2ff9c841f962
  • php7.4-phpdbg_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:b6e0ae7da9a8f59052bbb3d05d97726657f24bf5
  • php7.4-pspell_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:c03f4e9abe9903367fe6e58dc25b13a52b59ca72
  • php7.4-readline_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:32cd8868e1b5b809d72ac9a21feceff6f75dd728
  • php7.4-snmp_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:50a7bbeeb63f81d2102f1eeead7dcd1a4ba2b7a6
  • php7.4-soap_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:3572025d0c184a8b461fca47fb7293f0323187ee
  • php7.4-sqlite3_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:07102f5652c84896bddb4c5617cb696b4244574a
  • php7.4-sybase_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:29bf2432203eeec8550a435ee12d43f82b39bb37
  • php7.4-tidy_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:f5876e99125f001afb2b2c9ab5a05bdf56a47e84
  • php7.4-xml_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:9c9ba208825a2d18e657bd1ad007d264ad6652aa
  • php7.4-xmlrpc_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:a779373ab52742a6b1d0c58c6117133657fe11a4
  • php7.4-zip_7.4.3-4ubuntu2.29+tuxcare.els9_arm64.deb
    sha:545d064752457b5ef451c2bf410cca7667b7c7c5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.