[CLSA-2026:1791927706] Fix of 10 CVEs

Type:

security

Severity:

Important

Release date:

2026-10-13 21:42:04 UTC

Description:

   * SECURITY UPDATE: packet over-reads in the mysqlnd wire protocol parser
     - debian/patches/CVE-2025-1218.patch: check the remaining packet size
       before each read in ext/mysqlnd/mysqlnd_wireprotocol.c, and check the
       field length against the field type in ext/mysqlnd/mysqlnd_ps_codec.c
     - CVE-2025-1218
   * SECURITY UPDATE: heap buffer overflow in SOAP HTTP chunked responses
     - debian/patches/CVE-2025-14181.patch: use size_t lengths and checked
       reallocation for the response body in ext/soap/php_http.c
     - CVE-2025-14181
   * SECURITY UPDATE: phar tar entry injection via unchecked entry size
     - debian/patches/CVE-2026-6103.patch: reject unrepresentable entry sizes
       and skip the data of every entry type that has data in ext/phar/tar.c
     - CVE-2026-6103
   * SECURITY UPDATE: unbounded recursion in SOAP XML parsing and decoding
     - debian/patches/CVE-2026-91765.patch: walk XML nodes iteratively, reject
       documents nested deeper than 2048 levels and limit the decoding depth
       in ext/soap/php_xml.c and ext/soap/php_encoding.c
     - CVE-2026-91765
   * SECURITY UPDATE: credentials leaked to another origin on HTTP redirects
     - debian/patches/CVE-2026-91766.patch: strip the Authorization, Cookie
       and Proxy-Authorization user headers when a redirect changes the
       scheme, host or port in ext/standard/http_fopen_wrapper.c
     - CVE-2026-91766
   * SECURITY UPDATE: heap over-read in TLS wildcard certificate name
     matching
     - debian/patches/CVE-2026-91767.patch: include the wildcard prefix
       length in the subject length check in ext/openssl/xp_ssl.c
     - CVE-2026-91767
   * SECURITY UPDATE: FastCGI allowed_clients matched IPv6 clients on a /96
     prefix
     - debian/patches/CVE-2026-91768.patch: compare the full 16-byte IPv6
       address in fcgi_is_allowed() in main/fastcgi.c
     - CVE-2026-91768
   * SECURITY UPDATE: TLS peer name check fell back to the certificate CN
     when the certificate has a service identity
     - debian/patches/CVE-2026-91769.patch: do not fall back to the Common
       Name when the certificate has a DNS, URI or SRV subjectAltName in
       ext/openssl/xp_ssl.c
     - CVE-2026-91769
   * SECURITY UPDATE: heap over-read in convert stream filters with a NUL
     byte in line-break-chars
     - debian/patches/CVE-2026-92842.patch: duplicate line-break-chars with
       pestrndup() in ext/standard/filters.c
     - CVE-2026-92842
   * SECURITY UPDATE: heap over-read on an empty Location header in HTTP
     redirects
     - debian/patches/CVE-2026-93682.patch: use the stored Location length
       when resolving a relative redirect in
       ext/standard/http_fopen_wrapper.c
     - CVE-2026-93682

CVEs fixed:

Updated packages:

libapache2-mod-php7.4_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:685ef6b7d354498dfaf3de84e0300f543bd1042e
libphp7.4-embed_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:c7867fd60d199efaceab05c069c61e0d42ab80a9
php7.4_7.4.33-1+deb11u12+tuxcare.els1_all.deb
sha:4d5fbd227216c5549e41f057443ee358315faad1
php7.4-bcmath_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:d54b69027ee7d0bb4808a78e4377036e24883f61
php7.4-bz2_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:bfa6e41a45ce646934402498e601fb27fde4f41e
php7.4-cgi_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:08e1b8254a3e5537a350c77ee7575f9e44094bcc
php7.4-cli_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:439b945db1e1d86e440969f932ea33c7b05e6024
php7.4-common_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:45c27c6520b55248bca2089b92aebe7c99a42dbf
php7.4-curl_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:03e60d2e64a595e35b0c46f0819b5182a31f0542
php7.4-dba_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:4099f6ce960461781f7090d612f766eadc740142
php7.4-dev_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:8cfcab4b282dcf28417c2c09ac11db460e15b1c1
php7.4-enchant_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:3a0a7f7ba1e13d04d5a2dc2bd4b421291661004e
php7.4-fpm_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:5b07d508f754b1389ab3e433b95db68bdeff1f16
php7.4-gd_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:f68a6d17f97faf08994bbc21091c6a40b1924c8e
php7.4-gmp_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:542fb7bff56646ad938f7aab135025f7a1931ce2
php7.4-imap_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:0fc17acc51bb2140f0624d2edafeaa2f77e9f7b6
php7.4-interbase_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:c29af33e6714f7b803f83e6c060f5bf3dd7e4ee5
php7.4-intl_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:492971934f0568319c39e2a09502cdf5e4843385
php7.4-json_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:2c4e5b5eb5f5d6b5d7f2a1861252b240570427bd
php7.4-ldap_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:5f1461d6fab330275c79ef1dd3528b61e1189a61
php7.4-mbstring_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:147853a526cfd8495f6451c75097d4a3699df1c0
php7.4-mysql_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:4c1fe909b64f1f2f5cc1cb83ef4a36c63627952b
php7.4-odbc_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:15da5dd87938adbbd1940b471f92fd45b6c149d3
php7.4-opcache_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:3688310f3c0c7e8c5806ed9ad0b88ecaa451a609
php7.4-pgsql_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:55f61b7b12f47241e51157843c90cdb0ae69f1a6
php7.4-phpdbg_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:41a4496d53bb0ad684cef887a7cea589f6f118fa
php7.4-pspell_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:ac54654511ae6b13b77ad7ac98384d67d252a9b3
php7.4-readline_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:4ba881436b6ffb8b260bdf9b668c9710b05df9c2
php7.4-snmp_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:6a02bb779cf6d7a09984411841e1ebaabed16d2e
php7.4-soap_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:b3856d8f325025457ab45394ea1b1775cf9e5a01
php7.4-sqlite3_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:26ca789f5c7a459840cfa76186ee0f95536ab5ec
php7.4-sybase_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:a7333a1d3472f435480f261eacf1ad323c1a84f0
php7.4-tidy_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:23fd4c6ff4ffda05e0e4af8a44d0b4f01a3706d4
php7.4-xml_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:81652f4374ef2eafe7f46cfbdd1d066ab8601d91
php7.4-xmlrpc_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:cb533b176a5dfc7d0f053df7aa1898d2734d24df
php7.4-xsl_7.4.33-1+deb11u12+tuxcare.els1_all.deb
sha:220cda275fa569ed568b2a58c7c431e1ce7aca3a
php7.4-zip_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb
sha:fe2d55673ee9afa865c60a736a1af49bb0ddd3ba
libapache2-mod-php7.4_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:ce59db7c3195bd74f91f72b9eecff0628dfa0763
libphp7.4-embed_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:04e16d5c5d3444658873a5bc6d9183baa5ac1345
php7.4-bcmath_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:a550d73d4b25e3d945a7aa429de6128b42da0b97
php7.4-bz2_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:df83f829c48f53269c917b8a0b88381ae75bf44e
php7.4-cgi_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:49b2baf16d9adc62e126de4217a949c23d62f71e
php7.4-cli_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:fc39b9a6460b653a2c6064432dc51bc08ff7e362
php7.4-common_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:24754d9d98a6ca09fcbf2dc37455ad05c1fba9c8
php7.4-curl_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:8b891d288c2a9000b10036a03f9bcd8a0ab89c83
php7.4-dba_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:30d62d80955fc4b46bffa49f59d328ab5fe84beb
php7.4-dev_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:c0323c0ba49656b13995218da34ec86989f69c95
php7.4-enchant_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:1af699f0b12bbdbc11453fad2552f7a8d088f20b
php7.4-fpm_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:21579f2fb823b97d858635fd8b1269d8771443a9
php7.4-gd_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:7866b063df6741152b999f2ea4cbdf30b81ddcc9
php7.4-gmp_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:60c7d7b0ca8d5df3c66dc5b095e0f1139aa6833c
php7.4-imap_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:33efd9c45c5a0bb166520ea1e31afba17815c47c
php7.4-interbase_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:9c68c4ba0e635ddeefec2e213e52be99c84af4e4
php7.4-intl_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:2d5e3bf92720973daf8206003d67851ff13f3915
php7.4-json_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:150900fd7cb5369daf20dde51f59d34d1939788f
php7.4-ldap_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:3c86957b3eaa67f231d87ea83e1fc754a15b8fec
php7.4-mbstring_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:ba7bd7d5ecc1db5633a3932796562717d1163d2a
php7.4-mysql_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:102c90d641591a092fd3a8ee18c30c6051d3f764
php7.4-odbc_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:bef5c7b54b1bbe1c24e80b73eeac8b5abcd61331
php7.4-opcache_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:b67f6b70e9002051d521575388ebce2f87d10798
php7.4-pgsql_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:2e32af5461a0527dbfc20daf942dd39b4e02a292
php7.4-phpdbg_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:6a1ac24c6d0b46aaedbd6a803781fde4f06bc384
php7.4-pspell_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:bf27d3e2aabd5a6351c82a04cb9412496b14597f
php7.4-readline_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:6ec942ad97d285c2d31264e251de8e95ff49f062
php7.4-snmp_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:0c8b77e003ff21c849f052c8b248b34484653cb6
php7.4-soap_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:3bb3a91531b31eba84ce5c0228e0ef8e9fe35c10
php7.4-sqlite3_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:e0582f62a522c6242490e95675636235915d7ffb
php7.4-sybase_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:b8cfd17c49ac05b79476dbf8983796ed544acecd
php7.4-tidy_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:eab247a3b7e1b9fd7a439a25e102df7582e594ed
php7.4-xml_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:a5df4b0df8714e4cf8e7aed107067d8ade253e0c
php7.4-xmlrpc_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:5c862b53706c9b4c5850a185c38d23abeb7655b9
php7.4-zip_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb
sha:2790a46c7f6e170d30f7df937060cf77f511eb37
libapache2-mod-php7.4_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:672e4eeac8fda73249627e77acef34cf261544ef
libphp7.4-embed_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:9a89132df7ca1681447fe2f7d608d8e4a440e86b
php7.4-bcmath_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:28013a9cd59d5c7e67859d96f58d2805d2c8623b
php7.4-bz2_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:98fae96f15cc3d2d3350a18c10e41946f95a3090
php7.4-cgi_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:7934307512f11fbc869a2a89fc81b535ada25681
php7.4-cli_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:5b1cbb57a9088bfe768ac0ee7755c50e8012c3fd
php7.4-common_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:a1d512ec272245a9486b15d62048c9bb6d9486f8
php7.4-curl_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:cbb4af37790de8aebd444b0b3a5a8ed98d125c34
php7.4-dba_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:f70109c9d1f897c93f1138f6f83f4046ca36352a
php7.4-dev_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:b29a53614bb4af9eb5d2e018feb1ad732bed16ad
php7.4-enchant_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:d11faa161ca0c72440a665e9baa99902801b7de1
php7.4-fpm_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:ad8792c8ce342a0b4683deb2654d8349e0b804df
php7.4-gd_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:03dd6c4c28345bfc08416462ac13ac5d2027c0da
php7.4-gmp_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:f3495864e198d69359361ac54090825a82a8e7af
php7.4-imap_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:5d75a7fa634a45f97147a279aac2bd7258f39c5c
php7.4-interbase_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:4058464a8e5ffa8f3d56fbeb7cf9c57139c38916
php7.4-intl_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:fd5565956cfc797330263b2378578b196d57cc91
php7.4-json_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:d8bd1651cb234010944fbf48077f6761f7419064
php7.4-ldap_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:be7c8ff4f5e09fa376be6bd47b70766b39ee11f1
php7.4-mbstring_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:ad339d1fccb06e9c8972353d91d4e7338a6048ea
php7.4-mysql_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:e06bd7cfa60f11957b8eb61f7b3220e585b59f5b
php7.4-odbc_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:0d69caef52e3306d11af15e645a435a0f7557a4e
php7.4-opcache_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:a1f4cbc371f5468cd07670e86b8cf4ecb58bb61c
php7.4-pgsql_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:27a5346f0f7e3300af8250378423500c410cb99f
php7.4-phpdbg_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:c42015da8a62681afe53db04f5b8fcd5b71210ea
php7.4-pspell_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:f06df0168d98d67b9d7b55904ad2caa15fe8c8a0
php7.4-readline_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:363c74c3474711f89a4ee44c0475babbd14a7955
php7.4-snmp_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:b6c9f7b4b664f5d9100b01519a6ca165b953623a
php7.4-soap_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:4ddb35e1a64931c9ac4af7f6444d8034561a2211
php7.4-sqlite3_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:2abdaa1d6c009d978b59f5765290bec5b581f4a2
php7.4-sybase_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:53b34dab092cfeb7dc479d39830d205cc79c101e
php7.4-tidy_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:c86e009b561d7a32d0d86fc5487380beac9634a7
php7.4-xml_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:d1595d91fbc230aa77073801209a1b045fb541cf
php7.4-xmlrpc_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:da91f39cdc8ed4dbd3d67dba0acf6f81a9ee1bc7
php7.4-zip_7.4.33-1+deb11u12+tuxcare.els1_armel.deb
sha:adcb9da052c46814b891817aaa3d8aa7ed7cad4d

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.