[CLSA-2026:1784539589] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-20 09:26:52 UTC
Description:
* SECURITY UPDATE: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers - debian/patches/php-5.6-CVE-2026-14355.patch: backport upstream commit cbc0489126 (GH-22187) in ext/openssl/openssl.c — the output buffer was sized as data_len + one cipher block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and overflows the heap when built against OpenSSL 3.x. Reserve one extra block for EVP_CIPH_WRAP_MODE ciphers. - Note: upstream (PHP 8.x) sizes the buffer in the shared helper php_openssl_cipher_update(), which does not exist in 5.6. The fix is transposed to the inline allocations in both openssl_encrypt() (the exploitable path) and openssl_decrypt(), guarded by #ifdef EVP_CIPH_WRAP_MODE for older OpenSSL. - CVE-2026-14355
CVEs fixed:
Updated packages:
  • alt-php56_5.6.40-133_amd64.deb
    sha:5d19368103b74b05e41800614aa36ceebe75f743
  • alt-php56-bcmath_5.6.40-133_amd64.deb
    sha:d4f9e495e81b2507d4c0910199247867c5e27927
  • alt-php56-cli_5.6.40-133_amd64.deb
    sha:64ad3d5499a0f9d38f24eb98599e8d3cfb66baa8
  • alt-php56-common_5.6.40-133_amd64.deb
    sha:6c16c0e16c85d0919bb012dd18c5d810de60904d
  • alt-php56-dba_5.6.40-133_amd64.deb
    sha:d751be6483c931c3183ec468e225cff741ea801f
  • alt-php56-dbx_5.6.40-133_amd64.deb
    sha:26deee6058d3c63428c622e5ca2396ac731dfe9d
  • alt-php56-dev_5.6.40-133_amd64.deb
    sha:7b01726be228974f4406ae12782fff985fbd7bea
  • alt-php56-enchant_5.6.40-133_amd64.deb
    sha:9bccc226c7536e22e92ee1f059a17e0f1be55c56
  • alt-php56-firebird_5.6.40-133_amd64.deb
    sha:716c95f34caa764bb8f6eb8b6135247ba781369e
  • alt-php56-gd_5.6.40-133_amd64.deb
    sha:162901b9fee68ed88611aa5ef8747a9d85e3c1a9
  • alt-php56-imap_5.6.40-133_amd64.deb
    sha:3c0723295199819935e509e23e145bdb987f87d8
  • alt-php56-intl_5.6.40-133_amd64.deb
    sha:da56aa03e903036e34d0cf202f5bb316b6a39dbc
  • alt-php56-ldap_5.6.40-133_amd64.deb
    sha:e821916d90d775c6dc4229248fe60bc4909a89fd
  • alt-php56-mbstring_5.6.40-133_amd64.deb
    sha:0764e7dccf773d504a085e02996a0c6bbaff7263
  • alt-php56-mcrypt_5.6.40-133_amd64.deb
    sha:bca8b65f9eb750da23860ef3e478aa5c4c47e078
  • alt-php56-mysqlnd_5.6.40-133_amd64.deb
    sha:450e9b357f5c80103c4279c25f3e70d64d3574b9
  • alt-php56-odbc_5.6.40-133_amd64.deb
    sha:74b5eb98c6f3a817b42ddea98eaa8d8a680a5063
  • alt-php56-opcache_5.6.40-133_amd64.deb
    sha:0a0772547ecfce7e13ee77191d2493cb10b2a145
  • alt-php56-pdo_5.6.40-133_amd64.deb
    sha:8d999a328d48b01dbb8f597a28ef46ed1e7ae089
  • alt-php56-pgsql_5.6.40-133_amd64.deb
    sha:95f4951418d6922a7f7f79c534fb7ab041cad328
  • alt-php56-php-fpm_5.6.40-133_amd64.deb
    sha:1075c0a7e3a16cf7df44a4f3994727796d19c8b2
  • alt-php56-process_5.6.40-133_amd64.deb
    sha:df4f81314b3bbdb54f712c69ab3bcc039108cbe5
  • alt-php56-pspell_5.6.40-133_amd64.deb
    sha:72300d03cdc24b2335544a5ac1427e8256e136d8
  • alt-php56-recode_5.6.40-133_amd64.deb
    sha:591c91ff442a1d339ef3682f807501986acf4eb3
  • alt-php56-snmp_5.6.40-133_amd64.deb
    sha:1edd28309a23c7218144670113e9b09dc0ff2710
  • alt-php56-soap_5.6.40-133_amd64.deb
    sha:306e4f1565b8eda45b882de1bae77b4021cbc272
  • alt-php56-sybase_5.6.40-133_amd64.deb
    sha:f2dcb5ae14db46615ecd7cb8011f7a999452bd69
  • alt-php56-tidy_5.6.40-133_amd64.deb
    sha:c4ae5b2eda1d5f5750add24052eaf8e93e3231f5
  • alt-php56-xml_5.6.40-133_amd64.deb
    sha:67f298b5112a527bfbb7a5d3c45b3296cbbf7b2e
  • alt-php56-xmlrpc_5.6.40-133_amd64.deb
    sha:24985684868edf95dbebcd5d7c5ed90bd13b53cb
  • alt-php56_5.6.40-133_arm64.deb
    sha:7d293fcd12205332e6f5a0a06b14f5bab7730bb4
  • alt-php56-bcmath_5.6.40-133_arm64.deb
    sha:801b4cf233b69d2cd2308284b869d29808a7a41e
  • alt-php56-cli_5.6.40-133_arm64.deb
    sha:07804027771fb4119e48eb1318453bac9f778e26
  • alt-php56-common_5.6.40-133_arm64.deb
    sha:e6f6c8c2e711e39c1302894a9f9287ff16a96aeb
  • alt-php56-dba_5.6.40-133_arm64.deb
    sha:17b318a51ccf1a99a1a99563b50a908075eb8dac
  • alt-php56-dbx_5.6.40-133_arm64.deb
    sha:865da095f97e0e9bb656b519e0a5a75c118e8d24
  • alt-php56-dev_5.6.40-133_arm64.deb
    sha:01c5630be49c606cd0f08c9db8286409c1dfc95c
  • alt-php56-enchant_5.6.40-133_arm64.deb
    sha:47c495a2d3aa62d63335db1a379d0c2f44a8b7a2
  • alt-php56-firebird_5.6.40-133_arm64.deb
    sha:994f87eb88bc4531c7bd1c3bef987e3d8a6a3258
  • alt-php56-gd_5.6.40-133_arm64.deb
    sha:ef4859207a284cec280805c4d7493fea279146af
  • alt-php56-imap_5.6.40-133_arm64.deb
    sha:62f3996df185143debeb121101df721e570f713e
  • alt-php56-intl_5.6.40-133_arm64.deb
    sha:ba90add60f24b17c56288126ff3194586b53acb4
  • alt-php56-ldap_5.6.40-133_arm64.deb
    sha:dd9f7c64cc99b7e2876b2b90a63b0c77f24d3960
  • alt-php56-mbstring_5.6.40-133_arm64.deb
    sha:1a2703a738da0ee960088852ab666b4195df2f77
  • alt-php56-mcrypt_5.6.40-133_arm64.deb
    sha:0c2ad8a9be66d0b66297a9170de53a2ce62d6976
  • alt-php56-mysqlnd_5.6.40-133_arm64.deb
    sha:e780686c8e32766f01528e82c403aa6e4e15b01b
  • alt-php56-odbc_5.6.40-133_arm64.deb
    sha:2fb0d31c1dc86126fee73cb440805e1981815620
  • alt-php56-opcache_5.6.40-133_arm64.deb
    sha:d7873ec316d068de9a97ea2e6e4ef0201d2912b4
  • alt-php56-pdo_5.6.40-133_arm64.deb
    sha:76f601752a4cfcc8b17ab47464c886f9bce56b39
  • alt-php56-pgsql_5.6.40-133_arm64.deb
    sha:fa0386878d0b14a828b827e237456534cbc869bd
  • alt-php56-php-fpm_5.6.40-133_arm64.deb
    sha:3fb377cd797c856d05e6408b53bdf8d68c155889
  • alt-php56-process_5.6.40-133_arm64.deb
    sha:4306a8c2c44fdf66a601d75303906abaad9b11ad
  • alt-php56-pspell_5.6.40-133_arm64.deb
    sha:bad9467acb873a5944f2fa457aeeddba9a426f44
  • alt-php56-recode_5.6.40-133_arm64.deb
    sha:98ea25f89a08ee028171c89d9d829d22ff4bdbca
  • alt-php56-snmp_5.6.40-133_arm64.deb
    sha:cd8dd58e9479271cd3fa028b38f6967c84572d8b
  • alt-php56-soap_5.6.40-133_arm64.deb
    sha:e01ae71ee37f841391cc0cb6dad6d297b6ec0460
  • alt-php56-sybase_5.6.40-133_arm64.deb
    sha:9e8c30dd091864b76013c92828100182ad031099
  • alt-php56-tidy_5.6.40-133_arm64.deb
    sha:2909d1ed1ce338d4fdae0628ea494019ea6f411c
  • alt-php56-xml_5.6.40-133_arm64.deb
    sha:bec7e7f4a3e61ae95c0806f85895c0c81b54f352
  • alt-php56-xmlrpc_5.6.40-133_arm64.deb
    sha:be190d6d58b0294248db1ac72102c3fcf47b18e6
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.