[CLSA-2026:1784023456] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-14 10:04:32 UTC
Description:
* CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with padding (aes-*-wrap-pad, EVP_CIPH_WRAP_MODE). php_openssl_cipher_update() sized the output buffer as data_len + one cipher block, undersizing it for RFC 5649 padded wrap output (roundup(data_len, 8) + 8) and overflowing the zend_mm heap under OpenSSL 3.x. Reserve one extra block for wrap-mode ciphers. Backport of upstream php-src commit cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187).
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-23_amd64.deb
    sha:232913ed4ec52b65036cc0f43cab8429dd4d4b1f
  • alt-php81-bcmath_8.1.34-23_amd64.deb
    sha:9900f10815ca9c053b01aa216740569bbbb78286
  • alt-php81-cli_8.1.34-23_amd64.deb
    sha:d069a50555a5d24605315e21f1649158fe681ce2
  • alt-php81-common_8.1.34-23_amd64.deb
    sha:a5096243bc903bdda0ce679aa9a9df552ca6387f
  • alt-php81-dba_8.1.34-23_amd64.deb
    sha:cf3aaba2c4a5589874af35ee40508cfe7bda475f
  • alt-php81-dev_8.1.34-23_amd64.deb
    sha:4d711a3fbf5d592c46f98fa5addc03e09798c646
  • alt-php81-enchant_8.1.34-23_amd64.deb
    sha:00275c89214062e1caffbaa21283e3430458f1b1
  • alt-php81-firebird_8.1.34-23_amd64.deb
    sha:db7ae8f81ca235592c6b5eee47676ea287d7dd19
  • alt-php81-gd_8.1.34-23_amd64.deb
    sha:f0e565498937efdc4c8ad4d945e62af768cc99cc
  • alt-php81-imap_8.1.34-23_amd64.deb
    sha:d10b72543aba6151bacd46d66b8877af12961f1b
  • alt-php81-intl_8.1.34-23_amd64.deb
    sha:5488aa6e1e4316dc651f0f476dcb00e44a9b3c3c
  • alt-php81-ldap_8.1.34-23_amd64.deb
    sha:75e2cff6265309d7f91cc0080236ad09dc5a8098
  • alt-php81-mbstring_8.1.34-23_amd64.deb
    sha:21e14ab14f6ae3558167934fe71b35e5be1a6a81
  • alt-php81-mysqlnd_8.1.34-23_amd64.deb
    sha:493f816813112b9fbfd0c0a34747bffdd046e8ee
  • alt-php81-odbc_8.1.34-23_amd64.deb
    sha:cf2959543a8e69792d2a10c961be63a098d98f35
  • alt-php81-opcache_8.1.34-23_amd64.deb
    sha:0b474439bb77e9a934bb4fe26db1edbf5bb8db0f
  • alt-php81-pdo_8.1.34-23_amd64.deb
    sha:5117e46030a9b28a0aefdd363755018047108c0b
  • alt-php81-pgsql_8.1.34-23_amd64.deb
    sha:36baba8ef8e45b29c3719162e957eafd647fb9a1
  • alt-php81-php-fpm_8.1.34-23_amd64.deb
    sha:dce0972df326e12aab7de053d6489578e11e35d3
  • alt-php81-process_8.1.34-23_amd64.deb
    sha:e879650ca104c06510a84a9bb46ce4daef5d0da8
  • alt-php81-pspell_8.1.34-23_amd64.deb
    sha:73413ec4e20d83989a99d5ed5f35d824a3707899
  • alt-php81-snmp_8.1.34-23_amd64.deb
    sha:be9aa21aab3f829c40b34e07cbffed81d6315dd6
  • alt-php81-soap_8.1.34-23_amd64.deb
    sha:6ab66b126c72bdc374288978ce64b4f6be54614b
  • alt-php81-sodium_8.1.34-23_amd64.deb
    sha:5f30f0d67ec560deb6bd49e106bd634e73d281cb
  • alt-php81-tidy_8.1.34-23_amd64.deb
    sha:f688653fe42620a96f6c21d8d0f64c62fce46459
  • alt-php81-xml_8.1.34-23_amd64.deb
    sha:0ea9e914862a66747ba6503ebae7f7f4ea12a692
  • alt-php81_8.1.34-23_arm64.deb
    sha:9083a92cc3019934bd3ce7cac001eb51691376a9
  • alt-php81-bcmath_8.1.34-23_arm64.deb
    sha:2fad3f3e1a141abcc18bd347bacb1e1a29dc2537
  • alt-php81-cli_8.1.34-23_arm64.deb
    sha:d1657c2c018cc087edf6ece068dbea5126095009
  • alt-php81-common_8.1.34-23_arm64.deb
    sha:4469692034df022e7794379e247d157de96df151
  • alt-php81-dba_8.1.34-23_arm64.deb
    sha:a992fa7bdfa0d9560da7fc7a4afb77eaed68462a
  • alt-php81-dev_8.1.34-23_arm64.deb
    sha:f22037159fd6b5d8d491392d502e00e5ef770acc
  • alt-php81-enchant_8.1.34-23_arm64.deb
    sha:49306fd1d5b1c33e498a264ab650443fe3f7b17d
  • alt-php81-firebird_8.1.34-23_arm64.deb
    sha:f7837a1c8a5ebd50b4af8c0b19cb7bcd20e033c8
  • alt-php81-gd_8.1.34-23_arm64.deb
    sha:ec287ba50f2300cf07c6921475fe207113b6ada3
  • alt-php81-imap_8.1.34-23_arm64.deb
    sha:7185f86db45ecc4566092132509e14a579dad2f2
  • alt-php81-intl_8.1.34-23_arm64.deb
    sha:b811793f2f201319c0412b4bf3e56fdcd35f9abe
  • alt-php81-ldap_8.1.34-23_arm64.deb
    sha:c224d94f5c339203672ac1c385860ccc9b68a6ca
  • alt-php81-mbstring_8.1.34-23_arm64.deb
    sha:e0bad73305248fbf4943ed514a2b8cc610c9f71d
  • alt-php81-mysqlnd_8.1.34-23_arm64.deb
    sha:dcc8bd0fcdc00358e1a6e8bac4cb08f7273b4ea6
  • alt-php81-odbc_8.1.34-23_arm64.deb
    sha:d46ce58f321dd234e1fe8ba8705916b7511dbe7d
  • alt-php81-opcache_8.1.34-23_arm64.deb
    sha:201d981ced66ced92d0d7213b52a265d8c5c9cd6
  • alt-php81-pdo_8.1.34-23_arm64.deb
    sha:12e83e905d9a2ef214233eb3eeb361dc524937b3
  • alt-php81-pgsql_8.1.34-23_arm64.deb
    sha:28c559ed7aa64f590046893aaec8db796d69dad7
  • alt-php81-php-fpm_8.1.34-23_arm64.deb
    sha:7a30076e2f531dc44fcc152c76b8121e1c8c8a7b
  • alt-php81-process_8.1.34-23_arm64.deb
    sha:d9921381c6dfdefcf2aba605c2a299c7f5d17c2c
  • alt-php81-pspell_8.1.34-23_arm64.deb
    sha:95c80b5482e617554c5cff2b9afc41c32007d8f8
  • alt-php81-snmp_8.1.34-23_arm64.deb
    sha:a55c664f432b1a067505c184c1d5eeec3752795f
  • alt-php81-soap_8.1.34-23_arm64.deb
    sha:b49506a04c1e87a08d894cec00329e91ba35b582
  • alt-php81-sodium_8.1.34-23_arm64.deb
    sha:3d74e92e65449efbdbef822f3597041c90677c65
  • alt-php81-tidy_8.1.34-23_arm64.deb
    sha:84a0e728c55af6466878d1be940a354d4fab7dc8
  • alt-php81-xml_8.1.34-23_arm64.deb
    sha:012d900a95148baf08f59979e9fb9de62ab23ff9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.