[CLSA-2026:1784025650] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-14 10:41:07 UTC
Description:
* CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with padding (aes-*-wrap-pad, EVP_CIPH_WRAP_MODE). php_openssl_cipher_update() sized the output buffer as data_len + one cipher block, undersizing it for RFC 5649 padded wrap output (roundup(data_len, 8) + 8) and overflowing the zend_mm heap under OpenSSL 3.x. Reserve one extra block for wrap-mode ciphers. Backport of upstream php-src commit cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187).
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-23_amd64.deb
    sha:232913ed4ec52b65036cc0f43cab8429dd4d4b1f
  • alt-php81-bcmath_8.1.34-23_amd64.deb
    sha:5b0e2e5a026a8e8755a90321287b38e28c5b7f6e
  • alt-php81-cli_8.1.34-23_amd64.deb
    sha:37bf5964803e28ef6026a2a45d85ff791bcd970f
  • alt-php81-common_8.1.34-23_amd64.deb
    sha:b7a3e95cba0bb84840ef58af3f49a4e4211bcb00
  • alt-php81-dba_8.1.34-23_amd64.deb
    sha:00eee5517f5cb3249e3cc23571bc184fd5cca616
  • alt-php81-dev_8.1.34-23_amd64.deb
    sha:0b6bfb792ca247a8c039ced5e909a64dba0539ac
  • alt-php81-enchant_8.1.34-23_amd64.deb
    sha:418ae42cccc85a020567413b1f916a74ece75b0c
  • alt-php81-firebird_8.1.34-23_amd64.deb
    sha:0d771130c3cfbd189351c3c65348fea24fec8b32
  • alt-php81-gd_8.1.34-23_amd64.deb
    sha:e13e82e3cb6166172b40392e285a624ba813f335
  • alt-php81-imap_8.1.34-23_amd64.deb
    sha:d4e0184243ebac6fb5589005204f2c32991c3634
  • alt-php81-intl_8.1.34-23_amd64.deb
    sha:02f6871acdaba9bfd4fd5a9430ea6587e822107d
  • alt-php81-ldap_8.1.34-23_amd64.deb
    sha:ca3b9da12328c420f34ada7c15b53add8b304535
  • alt-php81-mbstring_8.1.34-23_amd64.deb
    sha:a5b3e88609195bdf5d5b06805bd56bb57d54927b
  • alt-php81-mysqlnd_8.1.34-23_amd64.deb
    sha:989b4f6aa494d3740f042739bf4a7897ed4924ed
  • alt-php81-odbc_8.1.34-23_amd64.deb
    sha:a108c1ebe7b549eae21ca7d62be828a2731d22b5
  • alt-php81-opcache_8.1.34-23_amd64.deb
    sha:6ac80c7bc2914730220f63bb4ee7f0e56df73133
  • alt-php81-pdo_8.1.34-23_amd64.deb
    sha:0c7fdb3c78dec1986450ad72b27d73330f7227d9
  • alt-php81-pgsql_8.1.34-23_amd64.deb
    sha:4f78a263c419416c389d83d33860e84ae27cc0b2
  • alt-php81-php-fpm_8.1.34-23_amd64.deb
    sha:0b6854e3d31ea72e348b09035d6ad9ff6c20d7c1
  • alt-php81-process_8.1.34-23_amd64.deb
    sha:642c5a6beee85a158097b4b4e06efeff75993f25
  • alt-php81-pspell_8.1.34-23_amd64.deb
    sha:709417e77f76f41a9bf2b09b61e7c8bbec78a9c6
  • alt-php81-snmp_8.1.34-23_amd64.deb
    sha:1cd24855fabe01c64c4dd8a7ad72f122e2c78dde
  • alt-php81-soap_8.1.34-23_amd64.deb
    sha:273d4f74afdc66a6ee498b9fdd1e8f1f631f52e5
  • alt-php81-sodium_8.1.34-23_amd64.deb
    sha:d907351c2bed32245dd61514022fc26d51678305
  • alt-php81-tidy_8.1.34-23_amd64.deb
    sha:022939463a994ae7d0b839edd6e68fa687170ea8
  • alt-php81-xml_8.1.34-23_amd64.deb
    sha:00fa7d5f514bcab4b37e91585ab7f66ac7f58936
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.