[CLSA-2026:1792692816] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 21:31:13 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator and the multipart request parser - debian/patches/php-5.4-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int; also disables the session upload-progress callback as upstream does on the EOL branches, so session.upload_progress.enabled no longer has any effect; adapted from upstream 712e60f9 (PHP 7.4 branch) - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php54_5.4.45-205_amd64.deb
    sha:c72258ec98f25bcb55b6122fcf99a7b74cf7dd71
  • alt-php54-bcmath_5.4.45-205_amd64.deb
    sha:af8d3c816a9f88bfdab6ce56d6e53ee9bc152064
  • alt-php54-cli_5.4.45-205_amd64.deb
    sha:1a8fa8e8a90f0a38440df129d00c42679911ad93
  • alt-php54-common_5.4.45-205_amd64.deb
    sha:e9f90d156972182f6e3aa26403e9d715e526f013
  • alt-php54-dba_5.4.45-205_amd64.deb
    sha:ea85cb555eda6a734f84fc5b0878c0cc7df8c912
  • alt-php54-dbx_5.4.45-205_amd64.deb
    sha:0a9f7b7636e2b77be566e467959592b93ea0b07e
  • alt-php54-dev_5.4.45-205_amd64.deb
    sha:a0e2cb9295c18488586e210b3b4d8ea26a12285e
  • alt-php54-enchant_5.4.45-205_amd64.deb
    sha:6a038b23272ab8284732d2d438e9307aef13e08a
  • alt-php54-firebird_5.4.45-205_amd64.deb
    sha:e98ff41bb7a62224edfcbaf918b7e6402b3901be
  • alt-php54-gd_5.4.45-205_amd64.deb
    sha:54f572f98bfdf19247388159126cd2c03fb5e4fb
  • alt-php54-imap_5.4.45-205_amd64.deb
    sha:517eca60b0b8b2ff20a5928d8bf4045d48b16d9c
  • alt-php54-intl_5.4.45-205_amd64.deb
    sha:138d60a2d5cacaa50c7b5510316ea917616baaac
  • alt-php54-ldap_5.4.45-205_amd64.deb
    sha:0f5587922bb2e5abf0e7e1c968ada493de208f84
  • alt-php54-mbstring_5.4.45-205_amd64.deb
    sha:0059fff85089e58ed22e9ec3c66121a0a92b3afa
  • alt-php54-mcrypt_5.4.45-205_amd64.deb
    sha:cd91568c5f66ff8f1a4ea4807d5fc90dc4eb9951
  • alt-php54-mssql_5.4.45-205_amd64.deb
    sha:98b55e0d48b917753840193a1176b1c6c801ad75
  • alt-php54-mysqlnd_5.4.45-205_amd64.deb
    sha:01f0dc2470031cd4a006db8eb6f1f6dea3a0b6fb
  • alt-php54-odbc_5.4.45-205_amd64.deb
    sha:ad18cecaf682c6b3299d8cf4cb22b4550f7874f7
  • alt-php54-pdo_5.4.45-205_amd64.deb
    sha:5fa3d7301f40de173718682480373de20bf61ed8
  • alt-php54-pgsql_5.4.45-205_amd64.deb
    sha:de989c30b59c611b18d3463a9f6d3d53f1011074
  • alt-php54-php-fpm_5.4.45-205_amd64.deb
    sha:f5622deba726aaa7db6be4a33408f073ec8cfe92
  • alt-php54-process_5.4.45-205_amd64.deb
    sha:ac07f6bae1cf3b7715df794dd0e34d59897912a0
  • alt-php54-pspell_5.4.45-205_amd64.deb
    sha:54ab2435d8e502d0a9971cc7ae17a2fcf0cb5dde
  • alt-php54-recode_5.4.45-205_amd64.deb
    sha:d46ca0ada2a6567de0d02c1923cc49e01c30bb14
  • alt-php54-snmp_5.4.45-205_amd64.deb
    sha:e7edf7875e4782c3b535d2ec4c242d4533abc85b
  • alt-php54-soap_5.4.45-205_amd64.deb
    sha:e552b782254b673ecff1ca8be703df80c9850196
  • alt-php54-sybase_5.4.45-205_amd64.deb
    sha:cf787eae3fc1b8feec8f8a0f7d6086685ab83ee6
  • alt-php54-tidy_5.4.45-205_amd64.deb
    sha:3d772199cc0d81d35471ee43bae3be776f841ac9
  • alt-php54-xml_5.4.45-205_amd64.deb
    sha:8b33f8690d7ae1821d48f85b2fe337538a211c61
  • alt-php54-xmlrpc_5.4.45-205_amd64.deb
    sha:379897fc592c2422b7b6a78a1b29bafb20649b89
  • alt-php54_5.4.45-205_arm64.deb
    sha:7302e6f5d3b1f4b415b6d1478112fc6bfd0af98b
  • alt-php54-bcmath_5.4.45-205_arm64.deb
    sha:841735fed356bb153e6c1dc249da917fbb494abf
  • alt-php54-cli_5.4.45-205_arm64.deb
    sha:7c732769dc2aef510857a156e72b8f5b3c5d736c
  • alt-php54-common_5.4.45-205_arm64.deb
    sha:199935f3324c41d61ef067fc60e45bf12b48b708
  • alt-php54-dba_5.4.45-205_arm64.deb
    sha:6279a37eb44a54464352ea507ef23d0b5c543b76
  • alt-php54-dbx_5.4.45-205_arm64.deb
    sha:a9c8cdcdff182c75d2e64114b6d3020299ef0927
  • alt-php54-dev_5.4.45-205_arm64.deb
    sha:d417e492c8bb94265c2645f3444d24f7d1f9ad42
  • alt-php54-enchant_5.4.45-205_arm64.deb
    sha:38c236812fbf054db29b463dc5ffd1b71e1e56c5
  • alt-php54-firebird_5.4.45-205_arm64.deb
    sha:a5f136c4491eadfbe13cffea22d9a23fab15227e
  • alt-php54-gd_5.4.45-205_arm64.deb
    sha:2b9e7391d8c1223695d265262fb26013c422b076
  • alt-php54-imap_5.4.45-205_arm64.deb
    sha:ad61afb9f5f5859b80d431d206f85ae06d1ce6d0
  • alt-php54-intl_5.4.45-205_arm64.deb
    sha:4c3fe58cda93b757d83055ff23418c071ace0b74
  • alt-php54-ldap_5.4.45-205_arm64.deb
    sha:5d66a5d589c6259918ebbf5309ddb82f801b687a
  • alt-php54-mbstring_5.4.45-205_arm64.deb
    sha:958317cb990fb9d33b100febefaa76f6af213a3f
  • alt-php54-mcrypt_5.4.45-205_arm64.deb
    sha:8afc24b1367b2b27fd9d8e9cf78e266ddcefdcb9
  • alt-php54-mssql_5.4.45-205_arm64.deb
    sha:b9903060e58c1f418354b5ff5ce2a19b38477130
  • alt-php54-mysqlnd_5.4.45-205_arm64.deb
    sha:5308a0615100be8152bf84d39e3c70592c417a8d
  • alt-php54-odbc_5.4.45-205_arm64.deb
    sha:0b98d1161ba40222fc1c33f7d9a7558630772476
  • alt-php54-pdo_5.4.45-205_arm64.deb
    sha:1929d5792b1d6eb5e9638f407e36defbf4a3a9d1
  • alt-php54-pgsql_5.4.45-205_arm64.deb
    sha:dcfdc3d6bf87571d5d4933198fab1b37d20a564d
  • alt-php54-php-fpm_5.4.45-205_arm64.deb
    sha:d1c28ee558ac7725c32da04496c3e2d3c06f4204
  • alt-php54-process_5.4.45-205_arm64.deb
    sha:d2a3f4ae066007def6dd2edac637ca5fac8c9ffd
  • alt-php54-pspell_5.4.45-205_arm64.deb
    sha:1fac1ec7860c44201f711796d80126a3464b4b4c
  • alt-php54-recode_5.4.45-205_arm64.deb
    sha:5e47253efb53d1e468bfb8a3b6ebf5945869d324
  • alt-php54-snmp_5.4.45-205_arm64.deb
    sha:f8721379aeaccc11077f1ca72d09764cac1f4eae
  • alt-php54-soap_5.4.45-205_arm64.deb
    sha:c4ddf8b006671fb20f7cca00faa68541345d63a2
  • alt-php54-sybase_5.4.45-205_arm64.deb
    sha:2c4f32b04aa86f595d24434e735ffd7df5537bf5
  • alt-php54-tidy_5.4.45-205_arm64.deb
    sha:562e88ac6730ecec774842bfd458a4e57ef59e08
  • alt-php54-xml_5.4.45-205_arm64.deb
    sha:4596d20478d7a9c0e17f59a409ee3b2414eb1c02
  • alt-php54-xmlrpc_5.4.45-205_arm64.deb
    sha:36e8df7902eaae4807957bf3730fc3ac9db5ea6f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.