Release date:
2026-07-20 08:09:49 UTC
Description:
* SECURITY UPDATE: openssl_encrypt() heap buffer overflow with AES
key-wrap-with-padding (aes-*-wrap-pad) ciphers
- debian/patches/php-5.6-CVE-2026-14355.patch: backport upstream commit
cbc0489126 (GH-22187) in ext/openssl/openssl.c — the output buffer was
sized as data_len + one cipher block, which under-sizes the RFC 5649
padded-wrap output (roundup(len,8)+8) and overflows the heap when built
against OpenSSL 3.x. Reserve one extra block for EVP_CIPH_WRAP_MODE
ciphers.
- Note: upstream (PHP 8.x) sizes the buffer in the shared helper
php_openssl_cipher_update(), which does not exist in 5.6. The fix is
transposed to the inline allocations in both openssl_encrypt() (the
exploitable path) and openssl_decrypt(), guarded by #ifdef
EVP_CIPH_WRAP_MODE for older OpenSSL.
- CVE-2026-14355
Updated packages:
-
alt-php56_5.6.40-133_amd64.deb
sha:0048ce7012276b6878598905cc17abbc213ce4ef
-
alt-php56-bcmath_5.6.40-133_amd64.deb
sha:f06b4768ceb18eea2645827f707b465191e1e21d
-
alt-php56-cli_5.6.40-133_amd64.deb
sha:69007dce514e69ac0793f4d18d2b00f4f986a253
-
alt-php56-common_5.6.40-133_amd64.deb
sha:2660ae0e63ac511f259c5c6e189079e54309162c
-
alt-php56-dba_5.6.40-133_amd64.deb
sha:37d050003e69d1073d8906d9260eab46924d1492
-
alt-php56-dbx_5.6.40-133_amd64.deb
sha:3d2dff6c5003fdaaf6a761d67e0a459a9b1e66a2
-
alt-php56-dev_5.6.40-133_amd64.deb
sha:9a0c4784852e2497a0f315f74af1ceddc3d7d4f5
-
alt-php56-enchant_5.6.40-133_amd64.deb
sha:19cfc78d9780d3f3c073146d84fc0d47336eda26
-
alt-php56-firebird_5.6.40-133_amd64.deb
sha:cc9e9d7183e8620d5b4215df8844ba554589af25
-
alt-php56-gd_5.6.40-133_amd64.deb
sha:8ccba50134d755c56b3f8c2cd0c19a413ccfeb07
-
alt-php56-imap_5.6.40-133_amd64.deb
sha:c3e86d332534f5df576076a48eedccaa94400e5b
-
alt-php56-intl_5.6.40-133_amd64.deb
sha:6051e1ca502264955558f334bb9686f9e601d140
-
alt-php56-ldap_5.6.40-133_amd64.deb
sha:695ad02e666d16d228f1f455f0bfaba26d7dab8c
-
alt-php56-mbstring_5.6.40-133_amd64.deb
sha:94eff03c04f5d7049ba46dda13183e60e1e33b10
-
alt-php56-mcrypt_5.6.40-133_amd64.deb
sha:9d7a831ec3f821176b36dd559a174ce4510a54da
-
alt-php56-mysqlnd_5.6.40-133_amd64.deb
sha:451ddf98c3ba9871c724058bd7c7b917eda84085
-
alt-php56-odbc_5.6.40-133_amd64.deb
sha:b8b5a21cd0d40ea70e6d1cf22a988c5b9ca88556
-
alt-php56-opcache_5.6.40-133_amd64.deb
sha:99f1c43123b2371155e69943de65cc6b4046411e
-
alt-php56-pdo_5.6.40-133_amd64.deb
sha:fa47f19170975fd85f20e22458db9898b6a9616a
-
alt-php56-pgsql_5.6.40-133_amd64.deb
sha:66ed68c063d4dd732a9495a605a95c1883f823e5
-
alt-php56-php-fpm_5.6.40-133_amd64.deb
sha:3f3fcf7f67ff0588d642638a815e7193ae8ef6e2
-
alt-php56-process_5.6.40-133_amd64.deb
sha:4f4267b6f84e4af5f23b8127061c2ad7978f0ed8
-
alt-php56-pspell_5.6.40-133_amd64.deb
sha:6645439b4181bad682f9f800d4285892f29b5825
-
alt-php56-recode_5.6.40-133_amd64.deb
sha:21d69f36e6e1cc15f54d1540e4e827427a28bd12
-
alt-php56-snmp_5.6.40-133_amd64.deb
sha:7fc10a2f1ba67327e010d683e3de41b9b638f36b
-
alt-php56-soap_5.6.40-133_amd64.deb
sha:00a36e1427c61b30f50a2f696939329a46f77df1
-
alt-php56-sybase_5.6.40-133_amd64.deb
sha:d7c3f7603333d1abcba6621839a6889c8f07a530
-
alt-php56-tidy_5.6.40-133_amd64.deb
sha:4826d054884e4485a96d37d17173993b29af6689
-
alt-php56-xml_5.6.40-133_amd64.deb
sha:2dfc2625d1463e7a12a8217ddbe76c97cccccaea
-
alt-php56-xmlrpc_5.6.40-133_amd64.deb
sha:ef03dda0d7336ec3ea431243b67de66f7ee6e874
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
