[CLSA-2026:1784536423] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-20 08:34:06 UTC
Description:
* CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + one block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and corrupts the zend heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE.
CVEs fixed:
Updated packages:
  • alt-php72_7.2.34-84_amd64.deb
    sha:bb39cb704877132e754a31ed99ce1015faa8bb1e
  • alt-php72-bcmath_7.2.34-84_amd64.deb
    sha:7a07ca7db87749f8809275b2c72cc81614ee3381
  • alt-php72-cli_7.2.34-84_amd64.deb
    sha:6e0becc6d598ce0ff10c0a3e51ff271d160fa2b3
  • alt-php72-common_7.2.34-84_amd64.deb
    sha:5c0efdeebdfce53164cdc852629ba66e157028e5
  • alt-php72-dba_7.2.34-84_amd64.deb
    sha:66fbee4d4de20b95ceaf1d7926552bd37ba1edcd
  • alt-php72-dev_7.2.34-84_amd64.deb
    sha:6ad5e4d245348aa79279637a433fa228cc7516ed
  • alt-php72-enchant_7.2.34-84_amd64.deb
    sha:23849d8568c1dd121a9dfef4e1fb04cca074d5e0
  • alt-php72-firebird_7.2.34-84_amd64.deb
    sha:b9014e61aae1c5dce5efb86cd2c1f167e23b5565
  • alt-php72-gd_7.2.34-84_amd64.deb
    sha:6be8cdb9bd1d6c4cbf393f70a8c410f8501734f7
  • alt-php72-imap_7.2.34-84_amd64.deb
    sha:49b5109957e170693e08925d9ca9a0ea0cbbc2f9
  • alt-php72-intl_7.2.34-84_amd64.deb
    sha:c4a66269b5d06610f2882ac7a2bc4023566f9930
  • alt-php72-ldap_7.2.34-84_amd64.deb
    sha:12570c2ce6f9b455cde2176875dd361a7ff2752e
  • alt-php72-mbstring_7.2.34-84_amd64.deb
    sha:5f3f35edd8fb2b4c865309198680db7881251e83
  • alt-php72-mysqlnd_7.2.34-84_amd64.deb
    sha:fcb6bee98458f4dba4d07c15572eae3333984c89
  • alt-php72-odbc_7.2.34-84_amd64.deb
    sha:d34b1e39290c9056e71789dfbdf0225832ad20ec
  • alt-php72-opcache_7.2.34-84_amd64.deb
    sha:113065ac4c34f0d716a6b9eb7772706e0e428072
  • alt-php72-pdo_7.2.34-84_amd64.deb
    sha:d368015c23058e9f8f1d21fe1f5eceb556dab3aa
  • alt-php72-pgsql_7.2.34-84_amd64.deb
    sha:b2b879c96f0ab849406a7c3d37c18357bbec192f
  • alt-php72-php-fpm_7.2.34-84_amd64.deb
    sha:964e8cb6b7949fcfe07ad668c076f3782639f522
  • alt-php72-process_7.2.34-84_amd64.deb
    sha:584768ec27cead007e0903f67742c5b886b4be13
  • alt-php72-pspell_7.2.34-84_amd64.deb
    sha:7394813e8bec6362c674d63d5e3b393b255f78d1
  • alt-php72-recode_7.2.34-84_amd64.deb
    sha:49bbbe498172b82c48aa66221370902036e68a64
  • alt-php72-snmp_7.2.34-84_amd64.deb
    sha:b20d365bc93f968521a45b6229caa55baa82b82f
  • alt-php72-soap_7.2.34-84_amd64.deb
    sha:afec28e83452002f5947e65a01b4b3c06d42de0e
  • alt-php72-sodium_7.2.34-84_amd64.deb
    sha:82ed300ea1f4212a36d6de8ffdb7026b4acb0f6a
  • alt-php72-tidy_7.2.34-84_amd64.deb
    sha:64a1a743e0458930e49c725b223317da171255a5
  • alt-php72-xml_7.2.34-84_amd64.deb
    sha:b44e1caf4c08139ae4b5cc8b8ffcef3bd67f777a
  • alt-php72-xmlrpc_7.2.34-84_amd64.deb
    sha:b024adfb1596e50d9e5f6d5dd2934271eda8b282
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.