[CLSA-2026:1784048069] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-14 16:54:46 UTC
Description:
* CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with AES key-wrap-pad (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + EVP_CIPHER_block_size, which under-sizes RFC 5649 padded-wrap output and overflows the heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream php-src cbc0489126a7682796aad1e5fb4e51de74af162c).
CVEs fixed:
Updated packages:
  • alt-php70_7.0.33-135_amd64.deb
    sha:867a3af00773b4297ddb71cf77c92f5ed6f7315f
  • alt-php70-bcmath_7.0.33-135_amd64.deb
    sha:63c75d63d023e5c26ad24adc4de8c59c6244d491
  • alt-php70-cli_7.0.33-135_amd64.deb
    sha:c5e5894145c911264e743519abac5e8591ba2d96
  • alt-php70-common_7.0.33-135_amd64.deb
    sha:83e100096e5d198e4e185c3451009fa68c93b266
  • alt-php70-dba_7.0.33-135_amd64.deb
    sha:887041d50237d6ce9b001224d392ce4742b3ba90
  • alt-php70-dev_7.0.33-135_amd64.deb
    sha:d011d84a6279e2d8b2abf8cf938743cb7d84cb00
  • alt-php70-enchant_7.0.33-135_amd64.deb
    sha:fbe3c07b85004d2fa78f20c5a67164bcdce58c45
  • alt-php70-firebird_7.0.33-135_amd64.deb
    sha:419693c5e1d2ceb395de86ab94a4a00a982c4f69
  • alt-php70-gd_7.0.33-135_amd64.deb
    sha:9f973b9ebb8aaf978ea6f5001508883c50e6285a
  • alt-php70-imap_7.0.33-135_amd64.deb
    sha:4b173674383da801dfb124d8764e176f3ae0c892
  • alt-php70-intl_7.0.33-135_amd64.deb
    sha:d99bd0160396e2f8259f4adb05ebe2576e642aed
  • alt-php70-ldap_7.0.33-135_amd64.deb
    sha:786cd2ae0904371d08d7a27e65042ca63d336bbc
  • alt-php70-mbstring_7.0.33-135_amd64.deb
    sha:3786b0159e8edff2d7e0572d7811ac64e3153357
  • alt-php70-mcrypt_7.0.33-135_amd64.deb
    sha:7982040e1e10ba8a189d0ab5ac6d10823d4337b8
  • alt-php70-mysqlnd_7.0.33-135_amd64.deb
    sha:e62eced4422598ce4d9a2199d01cdaf64d75eaa1
  • alt-php70-odbc_7.0.33-135_amd64.deb
    sha:37cfff83ddc191c8f6e45ffd7ab58d3bbd5c999d
  • alt-php70-opcache_7.0.33-135_amd64.deb
    sha:d5dc4c5c190aa667724b1a4b7c7ef7a3588b74c0
  • alt-php70-pdo_7.0.33-135_amd64.deb
    sha:f91cfacf7ada500212c9cfd2d07f1e6d9160b9fe
  • alt-php70-pgsql_7.0.33-135_amd64.deb
    sha:0d42d90672b2bc7297c66adaffb45d0d63844291
  • alt-php70-php-fpm_7.0.33-135_amd64.deb
    sha:6bd6ee38ba51397eb538be8be23f93df21442522
  • alt-php70-process_7.0.33-135_amd64.deb
    sha:59c05a9b82a877e9d9793c64923fde64f8cd6daa
  • alt-php70-pspell_7.0.33-135_amd64.deb
    sha:fcd963f5bfa8185dbe5ccc38445d6f9949cd6a3f
  • alt-php70-recode_7.0.33-135_amd64.deb
    sha:77251a2d4529ad99dfbd14f992263f2d66e47f5d
  • alt-php70-snmp_7.0.33-135_amd64.deb
    sha:ce07ce0adf48aaad2919207709a2705a38bba9d0
  • alt-php70-soap_7.0.33-135_amd64.deb
    sha:d7556746dab5df8e01709963b380ad7d3f0a503a
  • alt-php70-tidy_7.0.33-135_amd64.deb
    sha:51056ad73ae9b9fc89035386231441f7835fe594
  • alt-php70-xml_7.0.33-135_amd64.deb
    sha:f05949a2692d14bb53051d28bd79ef7ea0a786f3
  • alt-php70-xmlrpc_7.0.33-135_amd64.deb
    sha:16a2418a2287cdf793dd7e57c1680fa0dd32cdb3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.