[CLSA-2026:1792684676] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 15:58:08 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator and the multipart request parser - debian/patches/php-5.6-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int; also disables the session upload-progress callback as upstream does on the EOL branches, so session.upload_progress.enabled no longer has any effect; adapted from upstream 712e60f9 (PHP 7.4 branch) - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php56_5.6.40-150_amd64.deb
    sha:184710cd4d753a1f06d9da994f823dd6fbc35d92
  • alt-php56-bcmath_5.6.40-150_amd64.deb
    sha:c0791c9a7cfd70dc41b377de43dc3267e96692cb
  • alt-php56-cli_5.6.40-150_amd64.deb
    sha:1ad716eb961a167ec4b091eff28179144cb4fe8b
  • alt-php56-common_5.6.40-150_amd64.deb
    sha:f70483cf1371f6e9cb40354d44f753b3ec3c9ce3
  • alt-php56-dba_5.6.40-150_amd64.deb
    sha:125d54106b2da3b6446f278c9a6854f8d26dd709
  • alt-php56-dbx_5.6.40-150_amd64.deb
    sha:dc1b1c386f7d218998091c01fc2a4cc384a0ea1e
  • alt-php56-dev_5.6.40-150_amd64.deb
    sha:c1d884b5a208d4a33981d76a3fb1dd08436319f4
  • alt-php56-enchant_5.6.40-150_amd64.deb
    sha:ea9ceba8543a143d0a8a411450008d1ae547958b
  • alt-php56-firebird_5.6.40-150_amd64.deb
    sha:9ac590b4975af38a6e15fc403c4f4fc9110c7201
  • alt-php56-gd_5.6.40-150_amd64.deb
    sha:a212eee65ba22889e8f7008e81f405c54e9b7cdc
  • alt-php56-imap_5.6.40-150_amd64.deb
    sha:2c177ded31191e3bbc25030505986b6492664422
  • alt-php56-intl_5.6.40-150_amd64.deb
    sha:c0bdb3ff22d73dd44b869e7ec11dac4d7d501459
  • alt-php56-ldap_5.6.40-150_amd64.deb
    sha:d82779c52f5652c19afca49064c342a4660c13b4
  • alt-php56-mbstring_5.6.40-150_amd64.deb
    sha:20aa0590bec2d7cdfd0eb5787f125197f818f368
  • alt-php56-mcrypt_5.6.40-150_amd64.deb
    sha:022b5ac01359ea9e950c1508ea58a3421b68987a
  • alt-php56-mysqlnd_5.6.40-150_amd64.deb
    sha:c5d49ae19d8c179694bf66d25091f979f54832fd
  • alt-php56-odbc_5.6.40-150_amd64.deb
    sha:fd5f663584861d28e61eef3d76958deab99dc383
  • alt-php56-opcache_5.6.40-150_amd64.deb
    sha:472541dd9ec72fa1c8e8138a8c2471b3139ccbe3
  • alt-php56-pdo_5.6.40-150_amd64.deb
    sha:83dce12354d74f150033c1cd28dac180d1632d22
  • alt-php56-pgsql_5.6.40-150_amd64.deb
    sha:5d723165be346e86295bab30211469b341c9f131
  • alt-php56-php-fpm_5.6.40-150_amd64.deb
    sha:a5b8380054259610f4f2b112bda279d1281e719d
  • alt-php56-process_5.6.40-150_amd64.deb
    sha:49102c1d9d4bc6143ae8472a5f07fcefc5082962
  • alt-php56-pspell_5.6.40-150_amd64.deb
    sha:281b241a25a026d91f274d5a4271c28e804ab6ca
  • alt-php56-recode_5.6.40-150_amd64.deb
    sha:58cc52538e706528b291f2c659c66a36b429ef93
  • alt-php56-snmp_5.6.40-150_amd64.deb
    sha:6fdd8bcc4e54f9d85d9808a0f273e445aac10a53
  • alt-php56-soap_5.6.40-150_amd64.deb
    sha:ffcbfe2847de5ce73f21c58cfb79e17f41f78ef1
  • alt-php56-sybase_5.6.40-150_amd64.deb
    sha:c549d8a8345ca2c15bc93abb8e95bccc6445ae86
  • alt-php56-tidy_5.6.40-150_amd64.deb
    sha:36619144894abbef22c40196e8634dcf30f9b611
  • alt-php56-xml_5.6.40-150_amd64.deb
    sha:d49542185eb8d1e8d4cc9241331186fd7ac289e9
  • alt-php56-xmlrpc_5.6.40-150_amd64.deb
    sha:07313a22bdbd21d4118b527e30dde2b0df3992c5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.