[CLSA-2026:1784024832] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-14 10:27:29 UTC
Description:
* CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with padding (aes-*-wrap-pad, EVP_CIPH_WRAP_MODE). php_openssl_cipher_update() sized the output buffer as data_len + one cipher block, undersizing it for RFC 5649 padded wrap output (roundup(data_len, 8) + 8) and overflowing the zend_mm heap under OpenSSL 3.x. Reserve one extra block for wrap-mode ciphers. Backport of upstream php-src commit cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187).
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-23_amd64.deb
    sha:232913ed4ec52b65036cc0f43cab8429dd4d4b1f
  • alt-php81-bcmath_8.1.34-23_amd64.deb
    sha:73ed741c28c6b8e8a3387d5ebe0503908571827d
  • alt-php81-cli_8.1.34-23_amd64.deb
    sha:7cfd238a3e0923566aaf1e745f271cfb66271ae7
  • alt-php81-common_8.1.34-23_amd64.deb
    sha:ee1429dfed6687f50976e809fa5802ddc3e3898f
  • alt-php81-dba_8.1.34-23_amd64.deb
    sha:aa2ac2edaa0c2362cebffe341a7fa0fcc5f79894
  • alt-php81-dev_8.1.34-23_amd64.deb
    sha:d474f6d8988767b97fbfe84298df1e18d1f990f1
  • alt-php81-enchant_8.1.34-23_amd64.deb
    sha:152bcf2e3bf2d28a044293abd34927dac52ba075
  • alt-php81-firebird_8.1.34-23_amd64.deb
    sha:c75e0d56325399f0672b86e1bf2bae2d9c7fb781
  • alt-php81-gd_8.1.34-23_amd64.deb
    sha:3f09c30fa63a0de9808d679b19668706f7de6754
  • alt-php81-imap_8.1.34-23_amd64.deb
    sha:c7e26522c8d322dde66033d7e3cc0f74b10cdd19
  • alt-php81-intl_8.1.34-23_amd64.deb
    sha:66db6c5d0028288230b284b706bc471e869e4ae0
  • alt-php81-ldap_8.1.34-23_amd64.deb
    sha:ac43d06275246016804b18cd2bbb0647cd7d006a
  • alt-php81-mbstring_8.1.34-23_amd64.deb
    sha:9a9fff4017b3ecbad69bbf6c5878cc33d5567240
  • alt-php81-mysqlnd_8.1.34-23_amd64.deb
    sha:3ca170051c3f5de5706d837bcd420e2408360ed0
  • alt-php81-odbc_8.1.34-23_amd64.deb
    sha:a4fd75083377e9f68b1d7a8af3f57a4101dfca1a
  • alt-php81-opcache_8.1.34-23_amd64.deb
    sha:5f827d49b986a17948aa865f7314fabe15c13e82
  • alt-php81-pdo_8.1.34-23_amd64.deb
    sha:e116ee34a0add4a0c5bc8dbac020831387030560
  • alt-php81-pgsql_8.1.34-23_amd64.deb
    sha:89365e3b3b5132d9fc376eeeb10a6d1eb00cd7fb
  • alt-php81-php-fpm_8.1.34-23_amd64.deb
    sha:5995b6cf112f33cf39c07abfc063d0450e76878d
  • alt-php81-process_8.1.34-23_amd64.deb
    sha:d9f430ebdc2d826c1bb8191c5092b9c0062d64d6
  • alt-php81-pspell_8.1.34-23_amd64.deb
    sha:74af282e56457fcffb1dae758d15bbe7ef99664b
  • alt-php81-snmp_8.1.34-23_amd64.deb
    sha:1efd99a8602fc7f0b59eb9ab003e67527e56d8f3
  • alt-php81-soap_8.1.34-23_amd64.deb
    sha:1516561f79bb7bcbf83edcdfabe3ccb5725d5cb6
  • alt-php81-sodium_8.1.34-23_amd64.deb
    sha:98f0f6791bf6de34ccadcc5ff12e3be3a844b7da
  • alt-php81-tidy_8.1.34-23_amd64.deb
    sha:1ad787a57eceec5256b305149769498d9c6ab726
  • alt-php81-xml_8.1.34-23_amd64.deb
    sha:e5d21e78228fc58e51bb14b1a2b83aeb4f85dc78
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.