[CLSA-2026:1784304340] alt-php72: Fix of CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-17 16:06:05 UTC
Description:
- CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers; the output buffer was sized as data_len + one block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and corrupts the zend heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE.
CVEs fixed:
Updated packages:
  • alt-php72-7.2.34-84.el6.x86_64.rpm
    sha:391abe82c4f7f8e5ca81b5c8cc1d6a25a0160d09abcc6e8c2cfa198bcd182a60
  • alt-php72-bcmath-7.2.34-84.el6.x86_64.rpm
    sha:8ea1c94b57ad745a9b9d5fcd4c7a16ce7184c9208e799bef081999d3824c10ea
  • alt-php72-cli-7.2.34-84.el6.x86_64.rpm
    sha:96faa9ab06e991df0e00408f733d259d9313469439746af04f332da0cbcd744d
  • alt-php72-common-7.2.34-84.el6.x86_64.rpm
    sha:5e7b07f4e62ee27cac7b6dc59a4074ef8648ff332b2c0c58856bcefb8d0cde94
  • alt-php72-dba-7.2.34-84.el6.x86_64.rpm
    sha:6b0f1fc3e9bc8ef32355497275a414854c4a257206daa03c6148a2ad650de58d
  • alt-php72-devel-7.2.34-84.el6.x86_64.rpm
    sha:6a9c3cb46db971f448b28d52f109704e5c4e59b84bf1387b49732e85339c06bb
  • alt-php72-enchant-7.2.34-84.el6.x86_64.rpm
    sha:60956c2a24c9e8f92b466ca6b59a82c4daf7f0611ed9338eb9684e6761201b14
  • alt-php72-firebird-7.2.34-84.el6.x86_64.rpm
    sha:7ab79047b2d1dd3830431116d390795cca1a42f50fe75e10efff089a403272c6
  • alt-php72-gd-7.2.34-84.el6.x86_64.rpm
    sha:a38e0bc87c42d5c1568714048e7cbbc6d6722e84db7d1f734cd4c40817b15f5a
  • alt-php72-imap-7.2.34-84.el6.x86_64.rpm
    sha:95ce38be0b30fd948581c12254cde7c239351b9692c24b8da1e1e5fab8a572e8
  • alt-php72-intl-7.2.34-84.el6.x86_64.rpm
    sha:737ec9dddb1aa9d6cb51c729cea591a7312659b0f70ea8073a391e4610b9844e
  • alt-php72-ldap-7.2.34-84.el6.x86_64.rpm
    sha:fb6ae94de7d60363f9d5654aa68f97a2acaa82147e402b8620612c7bc0211407
  • alt-php72-mbstring-7.2.34-84.el6.x86_64.rpm
    sha:97101c828a3e7e4343c1022d1b9a53df819a17491d244d75bc42fa7b65866f9c
  • alt-php72-mysqlnd-7.2.34-84.el6.x86_64.rpm
    sha:e5a5bc5699119b904ca3632dafe29f5b34193ce56d4225a3284c7f9ddd3903d0
  • alt-php72-odbc-7.2.34-84.el6.x86_64.rpm
    sha:16a65c84dc54a8097233ae33f6a40cd9eec57bf74906e0055d86a03857249ac7
  • alt-php72-opcache-7.2.34-84.el6.x86_64.rpm
    sha:5c31b821097f216d31515c7cba319d48fdc53b5c8645f9987749f2bcf41f5a4d
  • alt-php72-pdo-7.2.34-84.el6.x86_64.rpm
    sha:ecb7cda04589c9040aec380b5d480f454d3296ea7ef3af31a09cf4ac0e3c3ecf
  • alt-php72-pgsql-7.2.34-84.el6.x86_64.rpm
    sha:5f7052ea237748128130273ee2bd02ef3bdc1cf3405398da717f4ba010137b1c
  • alt-php72-php-fpm-7.2.34-84.el6.x86_64.rpm
    sha:3f8524a5979db1839df93bdf58ddb4bdd53ad28d1dd86fbf3f82aa928b75fb4a
  • alt-php72-process-7.2.34-84.el6.x86_64.rpm
    sha:05bf61f60e64b0c5474edd516afe16931a4921f9123cdbe11b168a3a5e83c6d9
  • alt-php72-pspell-7.2.34-84.el6.x86_64.rpm
    sha:9052daf676fe42ff6c1aece58b35ca688229c0a8ae9cfc230ffe925c71f38404
  • alt-php72-recode-7.2.34-84.el6.x86_64.rpm
    sha:a5596a781a11012f9921a19da7496334f1470babe973e37ad76952727380b72d
  • alt-php72-snmp-7.2.34-84.el6.x86_64.rpm
    sha:fe2e570c8cd3e01690ee65488c15bc3b444c2ad20f3a79a5a69c8eed9d417c5b
  • alt-php72-soap-7.2.34-84.el6.x86_64.rpm
    sha:78daa39f2c5d093828cd0f623fc3792569e1a180059b38ccab49393c5f04b1aa
  • alt-php72-sodium-7.2.34-84.el6.x86_64.rpm
    sha:79822a3e33bd935d72969fc6ca64e38a79dff38be1cf35fa9dd3b7444b34932e
  • alt-php72-tidy-7.2.34-84.el6.x86_64.rpm
    sha:f58e11ef8e0a93f1cad48878179da6dafd43cb5738f0e7e00f566de23a23cf57
  • alt-php72-xml-7.2.34-84.el6.x86_64.rpm
    sha:ce651cb15e4af3d39ef6a07a2b207a8dd4a043c900f3236dea88eca67547869d
  • alt-php72-xmlrpc-7.2.34-84.el6.x86_64.rpm
    sha:d91b3811e34d9a747bd4f198d3b4101a3cfd5ad8f6526210eff0ddd7d78a1253
  • alt-php72-zts-7.2.34-84.el6.x86_64.rpm
    sha:89b09960383630e5ae2f395c0ffd0045c6cc2feb778de63475e136fad066a83e
  • alt-php72-zts-devel-7.2.34-84.el6.x86_64.rpm
    sha:493dd59da1ef86d06a189b004ea350346155563d8af2c0f8f6ce97b86170f70c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.