[CLSA-2026:1784102839] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-15 08:07:33 UTC
Description:
* CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with AES key-wrap-pad (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + EVP_CIPHER_block_size, which under-sizes RFC 5649 padded-wrap output and overflows the heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream php-src cbc0489126a7682796aad1e5fb4e51de74af162c).
CVEs fixed:
Updated packages:
  • alt-php70_7.0.33-135_amd64.deb
    sha:b53a0fe4d6a17361e0533170fb5f49d76839a785
  • alt-php70-bcmath_7.0.33-135_amd64.deb
    sha:b93ff93ed254243e92b1c88d1769fdf437d3ac22
  • alt-php70-cli_7.0.33-135_amd64.deb
    sha:36b122c3176db1d1361227955eac85929a1f727b
  • alt-php70-common_7.0.33-135_amd64.deb
    sha:116a0028957406ba1bf61519a818c399294ad9f8
  • alt-php70-dba_7.0.33-135_amd64.deb
    sha:05ea00a8e20c68cb53b71ba99e9faf1d029e8d3c
  • alt-php70-dev_7.0.33-135_amd64.deb
    sha:9e9fa46753d1550e5cab83082672adb9330fed6e
  • alt-php70-enchant_7.0.33-135_amd64.deb
    sha:82109641b40b8dc2671d7a0d460c866093d649d1
  • alt-php70-firebird_7.0.33-135_amd64.deb
    sha:8f5efd827133b3c28f155d89eef4739f7f274367
  • alt-php70-gd_7.0.33-135_amd64.deb
    sha:84ea1eff57290d4a15be186bb353d9aeb2a8a493
  • alt-php70-imap_7.0.33-135_amd64.deb
    sha:741cf6a2efdbe0b930bef4f595f85163009a470c
  • alt-php70-intl_7.0.33-135_amd64.deb
    sha:032dab1e3fea84dc442cb155d248acf4a8c050e6
  • alt-php70-ldap_7.0.33-135_amd64.deb
    sha:b33f1e15166938c514c9324a8600d2a40825509e
  • alt-php70-mbstring_7.0.33-135_amd64.deb
    sha:b28aefdfdaf340fb0cd590be5b8d8c5a558954c6
  • alt-php70-mcrypt_7.0.33-135_amd64.deb
    sha:0ec3551af1f2b4b424a05b6848eabee52ef27965
  • alt-php70-mysqlnd_7.0.33-135_amd64.deb
    sha:9d6fe4440010433815441acd781de14fb1bb42f9
  • alt-php70-odbc_7.0.33-135_amd64.deb
    sha:2a78ae16c97e179421f3b6c27a16fb536b7291db
  • alt-php70-opcache_7.0.33-135_amd64.deb
    sha:f8f2330acc8816cdf79ded3c4fc2b549faf57043
  • alt-php70-pdo_7.0.33-135_amd64.deb
    sha:359ccb7a3d6916c7491a113c5f87550ffdab13b9
  • alt-php70-pgsql_7.0.33-135_amd64.deb
    sha:9f8cf188a27534b994611702463aabb8f6cb1008
  • alt-php70-php-fpm_7.0.33-135_amd64.deb
    sha:484777a8238b2af66c1c7b04d784fbd7423eb76f
  • alt-php70-process_7.0.33-135_amd64.deb
    sha:e1fb43a7f8d782c51366d18caaf05afd10097dac
  • alt-php70-pspell_7.0.33-135_amd64.deb
    sha:4b848f920f08f200b40721dacc163ea864a15583
  • alt-php70-recode_7.0.33-135_amd64.deb
    sha:c017177d644953aea6ab204bbd65791db757e687
  • alt-php70-snmp_7.0.33-135_amd64.deb
    sha:13a1a39bf009de2d3c4fd02fadcef06b1935fc57
  • alt-php70-soap_7.0.33-135_amd64.deb
    sha:726e5bad6408a8996f6d53fde1f680fa1c85d525
  • alt-php70-tidy_7.0.33-135_amd64.deb
    sha:61cfa3a466fc9adf28c1595d5ed884aae156a18b
  • alt-php70-xml_7.0.33-135_amd64.deb
    sha:b6ed0bae82db5cfcad46c4bed7ec4cb5922b017e
  • alt-php70-xmlrpc_7.0.33-135_amd64.deb
    sha:b0084013ce930fd1e11ddd15bf506e5feb9d8032
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.