Stable Branch backport CVE-2026-9672 fix to external libgd 2.3.3 in 132.00stable

backport CVE-2026-9672 fix to external libgd 2.3.3 in 132.00stable

PHP's CVE-2026-9672 fix only covers its bundled libgd. PHP builds that opt
in to PHP_LIBGD_EXTERNAL='y' link Centmin Mod's own libgd 2.3.3 instead,
and no libgd release includes the fix yet. The default
PHP_LIBGD_EXTERNAL='n' build uses PHP's bundled libgd and is not affected.

Changes:
- patches/libgd/libgd-2.3.3-cve-2026-9672.patch: GIF LZW decoder fix for
src/gd_gif_in.c, backported from php-src commit fcd691b377d0
- php_configure.inc: apply the patch in install_libgd_external after the
gdflip patch, and stop the PHP build if it does not apply
- php_configure.inc: remove the previous libgd source tree and tarball
before each build, as 140.00beta01 and 141.00beta01 already do, so the
patch is never applied to an already patched tree on a repeat build
- the fix takes effect on the next PHP build via centmin.sh menu 5

Continue reading...

---

132.00stable branch

• Branch: https://github.com/centminmod/centminmod/tree/132.00stable
• Commit History: https://github.com/centminmod/centminmod/commits/132.00stable