ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

PostgreSQL extension

1 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

USN-8743-1: PHP vulnerabilities

Ubuntu fixes three PHP flaws, including SQL injection in the PostgreSQL extension (CVE-2026-17543) and an out-of-bounds write in bccomp().

Ubuntu Security Notice USN-8743-1 patches three vulnerabilities in PHP. CVE-2026-17543 involves incorrect backslash escaping in the PostgreSQL extension enabling SQL injection. CVE-2026-17544 is an out-of-bounds write in bccomp() that could cause denial of service or arbitrary code execution on Ubuntu 26.04 LTS, and CVE-2026-7260 causes unbounded recursion via circular symlinks in phar archives.

Ubuntu Security Noticesupdated · 4d agofirst · 5d agoAdvisory 13 sourcesCVE-2026-17543CVE-2026-17544CVE-2026-72601

Related CVEs

  • CVE-2026-175448.1<1%
    Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.*
    Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
    · php php—
  • CVE-2026-175438.1<1%
    Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* befo
    Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
    · php php—
  • CVE-2026-72605.4<1%
    Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* befo
    Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
    · php php—

Appears with

product PHP 1vendor Canonical 1vendor PHP 1vendor Ubuntu 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.