[CLSA-2026:1784570161] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-20 17:56:27 UTC
Description:
* SECURITY UPDATE: heap buffer overflow in openssl_encrypt()/openssl_decrypt() with AES key-wrap-with-padding ciphers - debian/patches/php-5.5-CVE-2026-14355.patch: backport upstream cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187) in ext/openssl/openssl.c - reserve one extra EVP_CIPHER_block_size for EVP_CIPH_WRAP_MODE ciphers (aes-*-wrap-pad, RFC 5649 output is roundup(len,8)+8) at the output-buffer allocation, which otherwise under-sizes and overflows the Zend MM heap when built against OpenSSL 3.x. 5.5 has no php_openssl_cipher_update() helper, so the fix is applied to both inline call sites (openssl_encrypt + openssl_decrypt). - CVE-2026-14355 - ELSLANG-59751, ELSLANG-59676, ELSLANG-59675, ELSLANG-59687, ELSLANG-59692
CVEs fixed:
Updated packages:
  • alt-php55_5.5.38-167_amd64.deb
    sha:e13c48d596102495fcbc514a443a3bc9f7d35f1e
  • alt-php55-bcmath_5.5.38-167_amd64.deb
    sha:53660c2d1e0c6a3c07f84b8be4bde839d6078ded
  • alt-php55-cli_5.5.38-167_amd64.deb
    sha:aafaddfd19c6f6f128f339b07b64610a07ec340d
  • alt-php55-common_5.5.38-167_amd64.deb
    sha:939f2b168da1bba2005ec5b304f47a3e023ce3a1
  • alt-php55-dba_5.5.38-167_amd64.deb
    sha:6d8ff95e041afe089563dd1e4fffd72a53d3d4ac
  • alt-php55-dbx_5.5.38-167_amd64.deb
    sha:03af460a54b030fa266194a01429df123e07aa8f
  • alt-php55-dev_5.5.38-167_amd64.deb
    sha:fbec4e70ce7e25cd4e7d9b6f466f56138ad4739d
  • alt-php55-enchant_5.5.38-167_amd64.deb
    sha:ff2c75e22bfccb7bd768b8f534ddffc180b82454
  • alt-php55-firebird_5.5.38-167_amd64.deb
    sha:d9853b5695442180964e6e92d90f760a5fdbcf1a
  • alt-php55-gd_5.5.38-167_amd64.deb
    sha:99a1925573c7b1f2eb341d63410ccc6f2e008fba
  • alt-php55-imap_5.5.38-167_amd64.deb
    sha:ad55880485090242653a2356b35268e538315b14
  • alt-php55-intl_5.5.38-167_amd64.deb
    sha:ed0e4be348adce952f4bcac2e40b6d81a6e13742
  • alt-php55-ldap_5.5.38-167_amd64.deb
    sha:a6b3791de38c46dc7ce0ba22ba4a407c57e7d410
  • alt-php55-mbstring_5.5.38-167_amd64.deb
    sha:e0a056ccb20bc5747aa301ca448ceb5e57a2c4d0
  • alt-php55-mcrypt_5.5.38-167_amd64.deb
    sha:84b998185f57d48a7e5fa588b7dec5797faf2a9b
  • alt-php55-mssql_5.5.38-167_amd64.deb
    sha:fcad9363449337fd9d9359bbc95240b2fc179340
  • alt-php55-mysqlnd_5.5.38-167_amd64.deb
    sha:ed6249ecb6d892a1ef8364ea78f2743c080521fd
  • alt-php55-odbc_5.5.38-167_amd64.deb
    sha:af68115ef9807585b69ba58890e447e0b6dc9f3c
  • alt-php55-pdo_5.5.38-167_amd64.deb
    sha:d2b14e475bf4353ab6d464043a229044500f2c3f
  • alt-php55-pgsql_5.5.38-167_amd64.deb
    sha:e19d384c41b9e80320802934d3c270b1dcbbb01c
  • alt-php55-php-fpm_5.5.38-167_amd64.deb
    sha:75e74bf3df112e223ea9b39380fbe14789487a40
  • alt-php55-process_5.5.38-167_amd64.deb
    sha:52746d7b136e0577184dd714b75a0066cf1ccea5
  • alt-php55-pspell_5.5.38-167_amd64.deb
    sha:7db49da491c1ffc65f8b73de516b96018185431d
  • alt-php55-recode_5.5.38-167_amd64.deb
    sha:5288284538006f9d609a0194a17a28df997c47f4
  • alt-php55-snmp_5.5.38-167_amd64.deb
    sha:cf233e92853fac841ad9fe7b82032ff64300216e
  • alt-php55-soap_5.5.38-167_amd64.deb
    sha:ab1290a6bbc9b6f29a255a8a65b2d662fd1ca196
  • alt-php55-sybase_5.5.38-167_amd64.deb
    sha:1ac2ca96a065f0393a0ad203fcb413c45ba85161
  • alt-php55-tidy_5.5.38-167_amd64.deb
    sha:fb3c5f0cb0aa0d8f2ed18315e194fce08e513c3d
  • alt-php55-xml_5.5.38-167_amd64.deb
    sha:f0a41278d99ad537818769cdd9e107def3ebb92c
  • alt-php55-xmlrpc_5.5.38-167_amd64.deb
    sha:6e156c6d704f7174a15bf4d0d8968f2ce91bbbd9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.