[CLSA-2026:1792684883] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 16:01:35 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator and the multipart request parser - debian/patches/php-5.6-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int; also disables the session upload-progress callback as upstream does on the EOL branches, so session.upload_progress.enabled no longer has any effect; adapted from upstream 712e60f9 (PHP 7.4 branch) - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php56_5.6.40-150_amd64.deb
    sha:184710cd4d753a1f06d9da994f823dd6fbc35d92
  • alt-php56-bcmath_5.6.40-150_amd64.deb
    sha:24cb54d2e3fdd859a02f12c64b74d259269b72ba
  • alt-php56-cli_5.6.40-150_amd64.deb
    sha:804bda565626f94c6a8d8dc2dac198ebe737ced9
  • alt-php56-common_5.6.40-150_amd64.deb
    sha:9cc524b25b09009d78174311c8788c2d3ded8418
  • alt-php56-dba_5.6.40-150_amd64.deb
    sha:fc20acc8f5f8e19613a63d19e1b3c1d5c632b48c
  • alt-php56-dbx_5.6.40-150_amd64.deb
    sha:59fa12203f1897325ebace19d874146435d739f1
  • alt-php56-dev_5.6.40-150_amd64.deb
    sha:46f5ccca785421b125b1666b5bcef6e22df49188
  • alt-php56-enchant_5.6.40-150_amd64.deb
    sha:acc072eb7e510e76465f7a6e2b020873d4d48aaf
  • alt-php56-firebird_5.6.40-150_amd64.deb
    sha:9d7c727a655e3bcfe312b3d04205a14ce46b79be
  • alt-php56-gd_5.6.40-150_amd64.deb
    sha:d87b7cf203f0940959e61a49e5dad364f9a59744
  • alt-php56-imap_5.6.40-150_amd64.deb
    sha:e62732b9b3766f8c87dc3af7c02653c123387fd1
  • alt-php56-intl_5.6.40-150_amd64.deb
    sha:e3828a2788950ecd5f1b0a290ad27b85592446d8
  • alt-php56-ldap_5.6.40-150_amd64.deb
    sha:01758d34525624100928ae8acc900706c2494aa2
  • alt-php56-mbstring_5.6.40-150_amd64.deb
    sha:2d90fd6b9c02cd9e5a943889096a7299d1fde91f
  • alt-php56-mcrypt_5.6.40-150_amd64.deb
    sha:db731359f5e5b8615a429e07435a7789823af4b3
  • alt-php56-mysqlnd_5.6.40-150_amd64.deb
    sha:16641551ab1c84f42bd297c0423bf14dbd0778f1
  • alt-php56-odbc_5.6.40-150_amd64.deb
    sha:47d41bca346588fe1f64713ce59151024b6e8f6b
  • alt-php56-opcache_5.6.40-150_amd64.deb
    sha:40adcbc2292aa8554a92e31dbd03a51a2a4b67b7
  • alt-php56-pdo_5.6.40-150_amd64.deb
    sha:3a30e44c1a292acf57cc25a048defdadf952294f
  • alt-php56-pgsql_5.6.40-150_amd64.deb
    sha:85c34f3c9abd01c1d2a18d0e59a1c8e8867faa7e
  • alt-php56-php-fpm_5.6.40-150_amd64.deb
    sha:7b61f0d35e2f14f98c63aa3e705efc4bc47b1855
  • alt-php56-process_5.6.40-150_amd64.deb
    sha:37042b809ec260c63994b26d776ccbf862576212
  • alt-php56-pspell_5.6.40-150_amd64.deb
    sha:527939a0337bec0f7dc0d11aa7842fb2a80206f2
  • alt-php56-recode_5.6.40-150_amd64.deb
    sha:072500d7a4b447fc36dfdf0182350d1c7a494a27
  • alt-php56-snmp_5.6.40-150_amd64.deb
    sha:65f7c25152daf61da40d2b0d97269ab6347923bb
  • alt-php56-soap_5.6.40-150_amd64.deb
    sha:bae064891a3059b6083820bf4edf4a5f16de9537
  • alt-php56-sybase_5.6.40-150_amd64.deb
    sha:52fce52aa2ac39f82a238e332c0e764d2d584ec7
  • alt-php56-tidy_5.6.40-150_amd64.deb
    sha:0f558b79b3aaa7f87ea1cf8b901581932e183a33
  • alt-php56-xml_5.6.40-150_amd64.deb
    sha:f7034d32a5e209628b3c3e9a99282f5192b3f5a8
  • alt-php56-xmlrpc_5.6.40-150_amd64.deb
    sha:c62e52d13d3371318503ce778654742fcd67851c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.