[CLSA-2026:1784556249] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-20 14:04:34 UTC
Description:
* SECURITY UPDATE: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers - debian/patches/php-5.6-CVE-2026-14355.patch: backport upstream commit cbc0489126 (GH-22187) in ext/openssl/openssl.c — the output buffer was sized as data_len + one cipher block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and overflows the heap when built against OpenSSL 3.x. Reserve one extra block for EVP_CIPH_WRAP_MODE ciphers. - Note: upstream (PHP 8.x) sizes the buffer in the shared helper php_openssl_cipher_update(), which does not exist in 5.6. The fix is transposed to the inline allocations in both openssl_encrypt() (the exploitable path) and openssl_decrypt(), guarded by #ifdef EVP_CIPH_WRAP_MODE for older OpenSSL. - CVE-2026-14355
CVEs fixed:
Updated packages:
  • alt-php56_5.6.40-133_amd64.deb
    sha:5d19368103b74b05e41800614aa36ceebe75f743
  • alt-php56-bcmath_5.6.40-133_amd64.deb
    sha:15f9037498a0158790996580afb955da26990dba
  • alt-php56-cli_5.6.40-133_amd64.deb
    sha:d06057621b32fb895c61a7b4a0999276da817309
  • alt-php56-common_5.6.40-133_amd64.deb
    sha:ba4e09f6147d56ed9d2d5e3effc4860bc5172a67
  • alt-php56-dba_5.6.40-133_amd64.deb
    sha:91cb9bb469c7fc7b14cb34c40d37fa216ac2fb4b
  • alt-php56-dbx_5.6.40-133_amd64.deb
    sha:a2464348c1da4c453b0166bf5789ee4ce8de1ec6
  • alt-php56-dev_5.6.40-133_amd64.deb
    sha:29ddab642341539dce69e68a103027915c107ff4
  • alt-php56-enchant_5.6.40-133_amd64.deb
    sha:84412d273874143ac29439944ade3968e4a03649
  • alt-php56-firebird_5.6.40-133_amd64.deb
    sha:967d77b2a797859ca3920213dc6724e85ef6bd89
  • alt-php56-gd_5.6.40-133_amd64.deb
    sha:2bc8528fac3834dab3bc885963f9329ad39e2c0a
  • alt-php56-imap_5.6.40-133_amd64.deb
    sha:9b2ec03e98aa488090a1e9d18a75a0941fb21c12
  • alt-php56-intl_5.6.40-133_amd64.deb
    sha:53fc834d57beba2f25b2cb1039d5dc4ba7abae8d
  • alt-php56-ldap_5.6.40-133_amd64.deb
    sha:c5e3a8f8dc65a937c9f362735d7a51ecdd9f0c35
  • alt-php56-mbstring_5.6.40-133_amd64.deb
    sha:c5dada856ff2ac46d65cd409f85a1cd62d803eb2
  • alt-php56-mcrypt_5.6.40-133_amd64.deb
    sha:6a992015033773cbc429a10d51c45f7b0822718b
  • alt-php56-mysqlnd_5.6.40-133_amd64.deb
    sha:aed909a2a4c09a04a8962753d7279b30d33eb981
  • alt-php56-odbc_5.6.40-133_amd64.deb
    sha:4e0f812e8d813aa04bdc55f6252d6ede7577f024
  • alt-php56-opcache_5.6.40-133_amd64.deb
    sha:b79ce8c8bdf810a68d688a7c641f214bb5f1e466
  • alt-php56-pdo_5.6.40-133_amd64.deb
    sha:3a4bcdd0a82edb6c14b08f468e8d1de61cc93e89
  • alt-php56-pgsql_5.6.40-133_amd64.deb
    sha:e5760dd63139febf49e03dc0b962920458dcb5f4
  • alt-php56-php-fpm_5.6.40-133_amd64.deb
    sha:87cf29697c47b90af59f24c0d0f056b6058063f0
  • alt-php56-process_5.6.40-133_amd64.deb
    sha:9724d6f0e3b9d06468c3f86ea6853931a753f19a
  • alt-php56-pspell_5.6.40-133_amd64.deb
    sha:fa621b00a7ef916b42ce458467aa884276c1ee7f
  • alt-php56-recode_5.6.40-133_amd64.deb
    sha:183dae127c865940d3d6286cd5f523a8c6d68d7a
  • alt-php56-snmp_5.6.40-133_amd64.deb
    sha:9df26bb66b7bc24285d3cc32d70ad7d6db6d2854
  • alt-php56-soap_5.6.40-133_amd64.deb
    sha:b489edc9d8b1c92e3d594afc583246fdb471cef1
  • alt-php56-sybase_5.6.40-133_amd64.deb
    sha:a6e4fee72daa6b5c2c9809205b15633616dd9a73
  • alt-php56-tidy_5.6.40-133_amd64.deb
    sha:5612c20860a0daa18e195b303045f99438a4cd69
  • alt-php56-xml_5.6.40-133_amd64.deb
    sha:6477d5a9e6a3cb29e933468cdf6c86bedd93b468
  • alt-php56-xmlrpc_5.6.40-133_amd64.deb
    sha:ab045e27cbc3f288d4bde2070c06198ea791f842
  • alt-php56_5.6.40-133_arm64.deb
    sha:7d293fcd12205332e6f5a0a06b14f5bab7730bb4
  • alt-php56-bcmath_5.6.40-133_arm64.deb
    sha:ed6b06ec670c4dc193f6c3759cdd2ca91682d5a2
  • alt-php56-cli_5.6.40-133_arm64.deb
    sha:92314793003361a93b28aff1379b3ec126314eed
  • alt-php56-common_5.6.40-133_arm64.deb
    sha:eea7c914d19ac18ca40f5a94095b8c386d784e03
  • alt-php56-dba_5.6.40-133_arm64.deb
    sha:82ead2188aa3781c03bbc8c5bfd52b9295a1a15b
  • alt-php56-dbx_5.6.40-133_arm64.deb
    sha:1e94716ead7e66a7f15832ed727e3fc388bff6b6
  • alt-php56-dev_5.6.40-133_arm64.deb
    sha:2cc0896f724494a4f6e9f7e8b2aeec97cc5f780d
  • alt-php56-enchant_5.6.40-133_arm64.deb
    sha:8b192e9632390a1ec60c1fb4f852c58110e74170
  • alt-php56-firebird_5.6.40-133_arm64.deb
    sha:cefa5b70b397108d49d40f0a3118bc4832f4eec5
  • alt-php56-gd_5.6.40-133_arm64.deb
    sha:98cfbf642c917ffc74862df256a59133d51fd00c
  • alt-php56-imap_5.6.40-133_arm64.deb
    sha:6ca9beafdf2f67e41eb4854660e1c6b4dce3b8be
  • alt-php56-intl_5.6.40-133_arm64.deb
    sha:4c677e21eaa905b9f1129fe63928d403d7c6899b
  • alt-php56-ldap_5.6.40-133_arm64.deb
    sha:56b63d4296e98f8dd6488a567e5a0758c7316acb
  • alt-php56-mbstring_5.6.40-133_arm64.deb
    sha:fde91f8008c51e2578d2dae1179f104e41f84d15
  • alt-php56-mcrypt_5.6.40-133_arm64.deb
    sha:9df9e195178e00077a1d51b2c9526bad82dca7b1
  • alt-php56-mysqlnd_5.6.40-133_arm64.deb
    sha:a8a9b2f1286732ef10a97e35a031d7acd642d65e
  • alt-php56-odbc_5.6.40-133_arm64.deb
    sha:4a4a7d7442d1fb0ecc0fa26f05142d2a3eb0e925
  • alt-php56-opcache_5.6.40-133_arm64.deb
    sha:9f105ba9b584fefe1d76ca3349aa0bb6d03de09e
  • alt-php56-pdo_5.6.40-133_arm64.deb
    sha:e15b5e58784169be0b09ebb369ca299e33ee07c9
  • alt-php56-pgsql_5.6.40-133_arm64.deb
    sha:e782fe6fdd4c0904ee76096be081e357f73be3dc
  • alt-php56-php-fpm_5.6.40-133_arm64.deb
    sha:37cc125159405e6ab715efa3bdfa2a94efe0fba9
  • alt-php56-process_5.6.40-133_arm64.deb
    sha:9968364e07bc9f2872e281d7e724a5670ea80a20
  • alt-php56-pspell_5.6.40-133_arm64.deb
    sha:450ffb00550a5178316202504276046ce1e1b164
  • alt-php56-recode_5.6.40-133_arm64.deb
    sha:feb00a2e3ac730a2c8abb2e9609759e5c464ec28
  • alt-php56-snmp_5.6.40-133_arm64.deb
    sha:f72015d2625e9700aa696ff0cb1c80014f15bc29
  • alt-php56-soap_5.6.40-133_arm64.deb
    sha:d1412f8cd5ab37ddbb8ddafa852b13f961f8eaac
  • alt-php56-sybase_5.6.40-133_arm64.deb
    sha:9428efd0fac6faa25cf143e68be5d4a725d1bfd5
  • alt-php56-tidy_5.6.40-133_arm64.deb
    sha:578ce6d6ca078858b78f120771439352204ef2eb
  • alt-php56-xml_5.6.40-133_arm64.deb
    sha:a335d5c53926fe1087dbf78e853da3b62904e5bb
  • alt-php56-xmlrpc_5.6.40-133_arm64.deb
    sha:0ec0812e63fb255985b6f918feff4463a2af1f6b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.