[CLSA-2026:1779284216] alt-php54: Fix of 4 CVEs
Type:
security
Severity:
Critical
Release date:
2026-05-20 13:37:22 UTC
Description:
- CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys (5.4 backport applies addref half only; ref_map ZVAL_PTR_DTOR is intentionally omitted because ref_map is heterogeneous in 5.x and the dtor would corrupt the xmlNodePtr entries — see patch header) - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string (5.4 backport applies HTML entity escape to both HTML and JSON /status endpoints since php_json_encode_string() isn't exported on 5.x — JSON consumers will see HTML entities in request_uri/query_string fields)
Updated packages:
  • alt-php54-5.4.45-178.el9.x86_64.rpm
    sha:f389b37228cb0f1afcc5ecd110a83787e7c64a1ed13a6d708ddf5993715a5611
  • alt-php54-bcmath-5.4.45-178.el9.x86_64.rpm
    sha:fdd4963a026d158811cee064ed9298b9652b40dcc86f899cd28bea7950b42b0e
  • alt-php54-cli-5.4.45-178.el9.x86_64.rpm
    sha:ab34a9ca7fe349f04fdc42484cd52d84f2d96e03f0be373f92287829f4cc3dd0
  • alt-php54-common-5.4.45-178.el9.x86_64.rpm
    sha:ea5572676dd00984e9585d71606c9f12038aef2bd9f100330b3022ed508becb7
  • alt-php54-dba-5.4.45-178.el9.x86_64.rpm
    sha:5bffcc28ba13e844b38e79f80ddd68c5c669966074cd7330fc72f82be76639b3
  • alt-php54-dbx-5.4.45-178.el9.x86_64.rpm
    sha:4baa0d831f4a41ab48b3fc44bb6bd7250e5373581d066e445f13b1eee458551e
  • alt-php54-devel-5.4.45-178.el9.x86_64.rpm
    sha:18a57d97cd35782e2c6bd95b824d85251cff6fee89f263d59e0df1f7b4bae753
  • alt-php54-enchant-5.4.45-178.el9.x86_64.rpm
    sha:83203cf1497beeaf9de98960b47755004bd0cda54d1665c4c51d72d8b0433c5f
  • alt-php54-firebird-5.4.45-178.el9.x86_64.rpm
    sha:bbf379eff03495331683a77fc220ed244e991f6528db6718d507f34e50261cf8
  • alt-php54-gd-5.4.45-178.el9.x86_64.rpm
    sha:4d5f585698f8334dc43a6ead368339bcca015de700cf73343dcf5dd7187ec5e3
  • alt-php54-imap-5.4.45-178.el9.x86_64.rpm
    sha:2d601301308dbc5222ff20559930bc093e7802a60a1b5cfbaa324905ad0d4e6b
  • alt-php54-intl-5.4.45-178.el9.x86_64.rpm
    sha:e1bf50af534f0b061b1894f84a5b84e08970d465bb3a12630b6d16dc54a52272
  • alt-php54-ldap-5.4.45-178.el9.x86_64.rpm
    sha:5dc8ac4ee78ccf798505b6189a102ad501f0f6afa9eefcb942391af87fbfeb69
  • alt-php54-mbstring-5.4.45-178.el9.x86_64.rpm
    sha:feee6a2b500eca69518386db92ad824fb0b9e23df4e7968565e976df915568c4
  • alt-php54-mcrypt-5.4.45-178.el9.x86_64.rpm
    sha:40dc83bf4933a3e3037681e0dbc0e0580965f8f1bda2d56315dbc1f447edf899
  • alt-php54-mssql-5.4.45-178.el9.x86_64.rpm
    sha:28816c2f984d36e582f47729ca0b569ece0b7780da80c8b0767b34dccd86a410
  • alt-php54-mysqlnd-5.4.45-178.el9.x86_64.rpm
    sha:18d35ea71267da5135f911389ca439b6f912ccba067b23c6f426b6413ff172ca
  • alt-php54-odbc-5.4.45-178.el9.x86_64.rpm
    sha:f6297da6be01f490d8d0e98e33480a66ea188b770f8b30c0dfd66844dd692348
  • alt-php54-pdo-5.4.45-178.el9.x86_64.rpm
    sha:4e6f87bae3a9bc3afcedc34b4bab575bd2653aa8eb97cc2320217978a2ebcdc9
  • alt-php54-pgsql-5.4.45-178.el9.x86_64.rpm
    sha:0df179cd5589f93db26f4962407a60ac838ba72e30b5a02e0d8e8c6152b37f24
  • alt-php54-php-fpm-5.4.45-178.el9.x86_64.rpm
    sha:268fbfa121a8757aaa42bef204cf370d9ee2f2671e9a3165bc3fe6e157d9b9e7
  • alt-php54-process-5.4.45-178.el9.x86_64.rpm
    sha:4c9c302c0ce0dfd0e83004d2115ba7859ce803806df6d44883b436368f9dac3e
  • alt-php54-pspell-5.4.45-178.el9.x86_64.rpm
    sha:a933afdfec93ea9c010a7e7d9efa2b6c222d8d768237f191d6d51ca1b4825a55
  • alt-php54-recode-5.4.45-178.el9.x86_64.rpm
    sha:9f5e3605187e34e216929ef976624b10c30ca5ae58f1d34c66f5385c0463d640
  • alt-php54-snmp-5.4.45-178.el9.x86_64.rpm
    sha:81324d972cc9ce1bcabf3529f8c7a4c26e9774adab5807ffd014b2eb189e5f5b
  • alt-php54-soap-5.4.45-178.el9.x86_64.rpm
    sha:1d408f41a4604ffefd7d208960a4d51c6e5532d8bc5e6329d51017e57b8c01c6
  • alt-php54-sybase-5.4.45-178.el9.x86_64.rpm
    sha:9f665e99495b13314816d713077968ac0b0778bf65d4dc209170a576807cd989
  • alt-php54-tidy-5.4.45-178.el9.x86_64.rpm
    sha:c6c1c03d036cadf587f8e0e56435162ded1ae36db02f732f2f3f9ea5ec146c97
  • alt-php54-xml-5.4.45-178.el9.x86_64.rpm
    sha:9538a8e276b4b4d8df69a9334b3c958482c58c07b547b0b275110c90b61bc18f
  • alt-php54-xmlrpc-5.4.45-178.el9.x86_64.rpm
    sha:2578511a73f7c654186a74f9e66585e6e69b259128c4530aebc22e29fc6680e8
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.