Release date:
2026-07-20 09:09:02 UTC
Description:
* SECURITY UPDATE: openssl_encrypt() heap buffer overflow with AES
key-wrap-with-padding (aes-*-wrap-pad) ciphers
- debian/patches/php-5.6-CVE-2026-14355.patch: backport upstream commit
cbc0489126 (GH-22187) in ext/openssl/openssl.c — the output buffer was
sized as data_len + one cipher block, which under-sizes the RFC 5649
padded-wrap output (roundup(len,8)+8) and overflows the heap when built
against OpenSSL 3.x. Reserve one extra block for EVP_CIPH_WRAP_MODE
ciphers.
- Note: upstream (PHP 8.x) sizes the buffer in the shared helper
php_openssl_cipher_update(), which does not exist in 5.6. The fix is
transposed to the inline allocations in both openssl_encrypt() (the
exploitable path) and openssl_decrypt(), guarded by #ifdef
EVP_CIPH_WRAP_MODE for older OpenSSL.
- CVE-2026-14355
Updated packages:
-
alt-php56_5.6.40-133_amd64.deb
sha:c93d578f18c34a2447e31a6e44499f39de7819bf
-
alt-php56-bcmath_5.6.40-133_amd64.deb
sha:587410692a7129d15368a2435a6e43ab35021316
-
alt-php56-cli_5.6.40-133_amd64.deb
sha:22305a21d9d6067b0e689599101207d6cba96417
-
alt-php56-common_5.6.40-133_amd64.deb
sha:39ef016bebfc131c418932a6c80de34c4e6b543d
-
alt-php56-dba_5.6.40-133_amd64.deb
sha:1b0c3444d5c1aa29c3c4aea1b392dae2c845f549
-
alt-php56-dbx_5.6.40-133_amd64.deb
sha:b9edb83a30bcd1b2b956f50ff959f3df2e6578da
-
alt-php56-dev_5.6.40-133_amd64.deb
sha:f76ff8d619b25411fa107dc82f570dc273129590
-
alt-php56-enchant_5.6.40-133_amd64.deb
sha:a4a233b09a3c521499d6bafc1df347f8fab0ecbe
-
alt-php56-firebird_5.6.40-133_amd64.deb
sha:d7b0181be2c30e44a3d04bdedebecee6479c6183
-
alt-php56-gd_5.6.40-133_amd64.deb
sha:4622c59dccce13ff1f3326fd8db0ab8dca83b362
-
alt-php56-imap_5.6.40-133_amd64.deb
sha:ea91120e712df9137a2c99c09942be18a66a56d3
-
alt-php56-intl_5.6.40-133_amd64.deb
sha:1f8dfffeb27ec6148e13dd8e277eb13841059cb1
-
alt-php56-ldap_5.6.40-133_amd64.deb
sha:ac73f3bffb40ef4be7e77843e12f5e37b88cab87
-
alt-php56-mbstring_5.6.40-133_amd64.deb
sha:70cb4fce78d179eb8f92439f85fff124a3611584
-
alt-php56-mcrypt_5.6.40-133_amd64.deb
sha:115482934188ec5f99d76de1dc9b75c638e24970
-
alt-php56-mysqlnd_5.6.40-133_amd64.deb
sha:553511145b3e9567b3f87fd33c1958f10497cb54
-
alt-php56-odbc_5.6.40-133_amd64.deb
sha:9789e5be4314eb968bfbe4c0ea3cba74923e74ee
-
alt-php56-opcache_5.6.40-133_amd64.deb
sha:c8e681f164d9875b83a7bd420db1f9ecb6823015
-
alt-php56-pdo_5.6.40-133_amd64.deb
sha:6a722527ee350a3b286634bf5c057f5391adfba9
-
alt-php56-pgsql_5.6.40-133_amd64.deb
sha:65f1b57925a913e760fe9e290217f4256cf15aea
-
alt-php56-php-fpm_5.6.40-133_amd64.deb
sha:cedcde9d065095fc9bc338ec6d9e73919f743bdc
-
alt-php56-process_5.6.40-133_amd64.deb
sha:b817caccc83cc8864d21a4accbbc8deb1bddb330
-
alt-php56-pspell_5.6.40-133_amd64.deb
sha:b1a84cc913375eac64ad04f7f83a291f19210937
-
alt-php56-recode_5.6.40-133_amd64.deb
sha:163aad4b5685c6f9029eea73bf2ba4db2881a254
-
alt-php56-snmp_5.6.40-133_amd64.deb
sha:6362ae21b024c2eef3d2c3e50dbc37f7afabae47
-
alt-php56-soap_5.6.40-133_amd64.deb
sha:500a61c4d3f46c5ff423a3931fdfa6eda943eb83
-
alt-php56-sybase_5.6.40-133_amd64.deb
sha:e98e0b92af5f83f8660028fda2c7a636d685cee2
-
alt-php56-tidy_5.6.40-133_amd64.deb
sha:1824aa7e1cab20cfbf4352d43149062d44577687
-
alt-php56-xml_5.6.40-133_amd64.deb
sha:3f91204de8bcb0facc0e0acc500eb6f37c96abba
-
alt-php56-xmlrpc_5.6.40-133_amd64.deb
sha:53a654de0c2e3b3a73098fdc0e09ee8a555cc366
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
