[CLSA-2026:1784026618] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-14 10:57:14 UTC
Description:
* CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with padding (aes-*-wrap-pad, EVP_CIPH_WRAP_MODE). php_openssl_cipher_update() sized the output buffer as data_len + one cipher block, undersizing it for RFC 5649 padded wrap output (roundup(data_len, 8) + 8) and overflowing the zend_mm heap under OpenSSL 3.x. Reserve one extra block for wrap-mode ciphers. Backport of upstream php-src commit cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187).
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-23_amd64.deb
    sha:232913ed4ec52b65036cc0f43cab8429dd4d4b1f
  • alt-php81-bcmath_8.1.34-23_amd64.deb
    sha:587f1b199b153aeda9b51c595da88c770ae40ed9
  • alt-php81-cli_8.1.34-23_amd64.deb
    sha:934a4ab64c0643c7ef3adeabe186a1eb02736791
  • alt-php81-common_8.1.34-23_amd64.deb
    sha:7cb8423bab36ea6e8b50af82c3bb85085b2e42bd
  • alt-php81-dba_8.1.34-23_amd64.deb
    sha:29f298882b17fc740fe86a2e6bd51f3ae2788293
  • alt-php81-dev_8.1.34-23_amd64.deb
    sha:02c5ae562e955310c18ce7c3b0d474549784bdd2
  • alt-php81-enchant_8.1.34-23_amd64.deb
    sha:78363dca0b501b0069e0df39eb24d846e5a8ea89
  • alt-php81-firebird_8.1.34-23_amd64.deb
    sha:15e62a63016ba179d47e618a52657009d70ab83d
  • alt-php81-gd_8.1.34-23_amd64.deb
    sha:1a0dbddd3770d21b04f4e4257842d63359a2bc48
  • alt-php81-imap_8.1.34-23_amd64.deb
    sha:73a866c80cc385d9fde90cfeb9cc68a0619c3be0
  • alt-php81-intl_8.1.34-23_amd64.deb
    sha:afda077ff5b85b5716c6e21c02f9d6eb150008aa
  • alt-php81-ldap_8.1.34-23_amd64.deb
    sha:53d61f4a0a5a25aceab1ef91b8dec3031f41c767
  • alt-php81-mbstring_8.1.34-23_amd64.deb
    sha:8e75865035e8a5365bf41a9365b7b4bf5412bbf5
  • alt-php81-mysqlnd_8.1.34-23_amd64.deb
    sha:973ec875eaf8314b6a1a597c0b2c4992319b1032
  • alt-php81-odbc_8.1.34-23_amd64.deb
    sha:88e5845d34f0407a2de9b4a0c3017e7a94af239c
  • alt-php81-opcache_8.1.34-23_amd64.deb
    sha:0364d1c9d5ff36b504aa9f7a7d2b833ac73877fc
  • alt-php81-pdo_8.1.34-23_amd64.deb
    sha:5d22f8065b18faa348e5fe7089d2b62ad7e6bf24
  • alt-php81-pgsql_8.1.34-23_amd64.deb
    sha:288ff37004b3342eba817adb8cc18becacf9a67d
  • alt-php81-php-fpm_8.1.34-23_amd64.deb
    sha:a8d73872612f0084e783c3fda9ff243edf1f42d4
  • alt-php81-process_8.1.34-23_amd64.deb
    sha:5a505be0118125a7a5f25f6bb63d94d380d9f936
  • alt-php81-pspell_8.1.34-23_amd64.deb
    sha:356462cd16e4cbc24fcd6a4885b192cb7f3d7fb9
  • alt-php81-snmp_8.1.34-23_amd64.deb
    sha:414dd3346faee3b78f84f57a95bf502f3278684b
  • alt-php81-soap_8.1.34-23_amd64.deb
    sha:d462da9bf73c90a129d32a089d28a08c4032d19e
  • alt-php81-sodium_8.1.34-23_amd64.deb
    sha:d5005356e040c57c7a83c8453c1afae93a805289
  • alt-php81-tidy_8.1.34-23_amd64.deb
    sha:c0ca6983a1ec0abdbf45475af46cb0b35b538f91
  • alt-php81-xml_8.1.34-23_amd64.deb
    sha:7566360fc28539e09e679281d465015b4f1b7a9e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.