[CLSA-2026:1784018448] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-14 08:41:05 UTC
Description:
* CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with padding (aes-*-wrap-pad, EVP_CIPH_WRAP_MODE). php_openssl_cipher_update() sized the output buffer as data_len + one cipher block, undersizing it for RFC 5649 padded wrap output (roundup(data_len, 8) + 8) and overflowing the zend_mm heap under OpenSSL 3.x. Reserve one extra block for wrap-mode ciphers. Backport of upstream php-src commit cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187).
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-23_amd64.deb
    sha:ba4598c25d43f19247960fa7bac009da3f56f09b
  • alt-php81-bcmath_8.1.34-23_amd64.deb
    sha:649db180610569a614d2a24df75268b1a4af8f32
  • alt-php81-cli_8.1.34-23_amd64.deb
    sha:0cbb8f4e00b56825eab7d3607aa602e86bbbc626
  • alt-php81-common_8.1.34-23_amd64.deb
    sha:a899fe8bb6852fffdc42a2b23bc9c4ac17af747c
  • alt-php81-dba_8.1.34-23_amd64.deb
    sha:df18c0bed8cfd93d8425623761cf550993193130
  • alt-php81-dev_8.1.34-23_amd64.deb
    sha:245e4d770699cfd1685da09cfc98660d6cb001d2
  • alt-php81-enchant_8.1.34-23_amd64.deb
    sha:b1888b6b0881c3a43ea34b2462442e29bd96716a
  • alt-php81-firebird_8.1.34-23_amd64.deb
    sha:0dd9a9bea01da3046c0db5a3764688fddc838a29
  • alt-php81-gd_8.1.34-23_amd64.deb
    sha:da8236084255b5c8316e663b2b5a504065043c51
  • alt-php81-imap_8.1.34-23_amd64.deb
    sha:d559bab536e60d3820dd9d66d1ab2b2ba62f6977
  • alt-php81-intl_8.1.34-23_amd64.deb
    sha:de5e8f9ab77731a86e5a2d779edcafa7175fff58
  • alt-php81-ldap_8.1.34-23_amd64.deb
    sha:2d5f0166ec9c04c5b672c9fa66b4bedf16cbf5f9
  • alt-php81-mbstring_8.1.34-23_amd64.deb
    sha:e7d9e991b7ec716954a59e4b9d148e7b2b3eb375
  • alt-php81-mysqlnd_8.1.34-23_amd64.deb
    sha:562f57b9a7b2405a9d7a788658ecf21ffe6538fa
  • alt-php81-odbc_8.1.34-23_amd64.deb
    sha:69f3cd6e68ebe1f0647df0c815ea71c4ac0601c1
  • alt-php81-opcache_8.1.34-23_amd64.deb
    sha:4d6d3ae4cc609c60f07036fc6647c5f258b3cd28
  • alt-php81-pdo_8.1.34-23_amd64.deb
    sha:288e4419e9499e7ec9bade0f68c8bf1dbabc0eb4
  • alt-php81-pgsql_8.1.34-23_amd64.deb
    sha:c80f30fd43241fc3207f19bc2ae52f9b33b8a9c3
  • alt-php81-php-fpm_8.1.34-23_amd64.deb
    sha:3c03b02b589b42833125c3864b2eb027c4319a05
  • alt-php81-process_8.1.34-23_amd64.deb
    sha:ebd390e58056c16f8251e0c59ffdf0a80b1ed0eb
  • alt-php81-pspell_8.1.34-23_amd64.deb
    sha:b549de5e75a1326323fc875d632603551a0c9b8d
  • alt-php81-snmp_8.1.34-23_amd64.deb
    sha:782d21c3dd77a5c8ae20092918df354607371b11
  • alt-php81-soap_8.1.34-23_amd64.deb
    sha:6e180513c6554dd53bdd1563d24758cd4262faa8
  • alt-php81-sodium_8.1.34-23_amd64.deb
    sha:69e3b84dc7229d3d1397470aeccf34213e7e730d
  • alt-php81-tidy_8.1.34-23_amd64.deb
    sha:dbc5452b357b65541e75fa72f4ae895d2ba42df6
  • alt-php81-xml_8.1.34-23_amd64.deb
    sha:6e658669701e7e407833d1d0cc6f3d0e48165415
  • alt-php81_8.1.34-23_arm64.deb
    sha:99dea0403eae586fc1847bba35ec0df64d7623b2
  • alt-php81-bcmath_8.1.34-23_arm64.deb
    sha:6319acb3017c52100df54d8f4bead0be6683a4d5
  • alt-php81-cli_8.1.34-23_arm64.deb
    sha:14f88fdcc51a4ee8ec5ea4018bcdb5aaf6d62525
  • alt-php81-common_8.1.34-23_arm64.deb
    sha:b1d68bc1da41bfdd7213ced8782e772f4eb67eaf
  • alt-php81-dba_8.1.34-23_arm64.deb
    sha:e4ca6c8c10b2d678c20171f349fc3b83946305ff
  • alt-php81-dev_8.1.34-23_arm64.deb
    sha:9a800a9dac537e3d289259133f40daccdc3c98fa
  • alt-php81-enchant_8.1.34-23_arm64.deb
    sha:1897198f1f317146baba847a310f79d6670b7144
  • alt-php81-firebird_8.1.34-23_arm64.deb
    sha:3110fc4c63c30dfb495212c5f4e8ef301739b8d4
  • alt-php81-gd_8.1.34-23_arm64.deb
    sha:00925a4a910ac63dcb1b145ed003e3514529ddd3
  • alt-php81-imap_8.1.34-23_arm64.deb
    sha:08190dcf33c7893c49375f08e6bedae6f3fb67e9
  • alt-php81-intl_8.1.34-23_arm64.deb
    sha:8cbd9373888f01e3aa584537bd1661b093ae0de1
  • alt-php81-ldap_8.1.34-23_arm64.deb
    sha:5a70091657dacb45b7989b42208e53d5ce6d852b
  • alt-php81-mbstring_8.1.34-23_arm64.deb
    sha:479034d5bce92cb9a4f410850212ae3d8f47d54f
  • alt-php81-mysqlnd_8.1.34-23_arm64.deb
    sha:95e19fc648e1bdb3a98440cb5c09c842d7264fbe
  • alt-php81-odbc_8.1.34-23_arm64.deb
    sha:e680c8b29a6f7a020abd16917288b858bac9b1e9
  • alt-php81-opcache_8.1.34-23_arm64.deb
    sha:eec7cc9503582577f516926e1142fa32d4865163
  • alt-php81-pdo_8.1.34-23_arm64.deb
    sha:ee6634b3311373d793d0cc5a48a1dd01b83837eb
  • alt-php81-pgsql_8.1.34-23_arm64.deb
    sha:90ebf98accef1aafad89bc11ff9940ee9224df8a
  • alt-php81-php-fpm_8.1.34-23_arm64.deb
    sha:21895071ee24af3f2f9817ef9c43f98fbfeb6814
  • alt-php81-process_8.1.34-23_arm64.deb
    sha:d4dea0810ea1acba2ef3c70cdd55fec898c4be96
  • alt-php81-pspell_8.1.34-23_arm64.deb
    sha:bd749b09d36bd90f5dd3adc6a1f8cf7dd599ef5f
  • alt-php81-snmp_8.1.34-23_arm64.deb
    sha:f28753bde0e26d5ffbe93486a6b22f09e2fd9e62
  • alt-php81-soap_8.1.34-23_arm64.deb
    sha:ada683b289cdaf0c82fcba9513534817db539060
  • alt-php81-sodium_8.1.34-23_arm64.deb
    sha:02a2f57e4e624498b71f5dd9807a863609fdf21b
  • alt-php81-tidy_8.1.34-23_arm64.deb
    sha:41d685dadf48fd24e58206d5966b2aaf0e8d2bab
  • alt-php81-xml_8.1.34-23_arm64.deb
    sha:5a9b62685edbdc56f9ff216ff7a56ae9ed11c492
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.