[CLSA-2026:1784046047] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-14 16:21:05 UTC
Description:
* CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with AES key-wrap-pad (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + EVP_CIPHER_block_size, which under-sizes RFC 5649 padded-wrap output and overflows the heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream php-src cbc0489126a7682796aad1e5fb4e51de74af162c).
CVEs fixed:
Updated packages:
  • alt-php70_7.0.33-135_amd64.deb
    sha:b698d792d0f87fb63fc837cc7487f272a93e5027
  • alt-php70-bcmath_7.0.33-135_amd64.deb
    sha:9704c5e0a46aacb483ec07464c3e265b30b374c6
  • alt-php70-cli_7.0.33-135_amd64.deb
    sha:e4b7770b736a2f298f7e8b6f71d1375087635af0
  • alt-php70-common_7.0.33-135_amd64.deb
    sha:d57d85608ac2c9dde31c3f452d9af42700857475
  • alt-php70-dba_7.0.33-135_amd64.deb
    sha:7e862761a9563f2396e60974f9b5a90ad3396d5a
  • alt-php70-dev_7.0.33-135_amd64.deb
    sha:54a8a6481c596dd55cbb8c81a08c1b10c3160df1
  • alt-php70-enchant_7.0.33-135_amd64.deb
    sha:6d465692574ad138bc3d14050d8714466626137a
  • alt-php70-firebird_7.0.33-135_amd64.deb
    sha:e8adea7082371f1fa68fbe24289a20616baa8e8c
  • alt-php70-gd_7.0.33-135_amd64.deb
    sha:c55de9e1a81e8e4decff24f1a0d431791d4c4b3e
  • alt-php70-imap_7.0.33-135_amd64.deb
    sha:c9abff02e335e8e365224919b9a61275debe683c
  • alt-php70-intl_7.0.33-135_amd64.deb
    sha:e94834c7c934f98a6848d6cc61f6f604d1bc49cb
  • alt-php70-ldap_7.0.33-135_amd64.deb
    sha:552b6d6a20c71730d8bda4a68f14778dc099a7af
  • alt-php70-mbstring_7.0.33-135_amd64.deb
    sha:a4bf1a60f99fc13c127750a4cf4ad2dbc991487b
  • alt-php70-mcrypt_7.0.33-135_amd64.deb
    sha:5df2c59d21e4e7f65c995a8d6807209ce058ee2a
  • alt-php70-mysqlnd_7.0.33-135_amd64.deb
    sha:1935b29c72ad8b68dc4cbe28029d0a7227c8b325
  • alt-php70-odbc_7.0.33-135_amd64.deb
    sha:97d7e393baeb3cbb48497f9b503d8791dd948120
  • alt-php70-opcache_7.0.33-135_amd64.deb
    sha:f942093dc09536b6beeb496a589c95ba11dab3b3
  • alt-php70-pdo_7.0.33-135_amd64.deb
    sha:674b3bce885f41b7d600db484c5f91ca66ff7212
  • alt-php70-pgsql_7.0.33-135_amd64.deb
    sha:8e44fbc32bc7de55018e1b8c2ce8f1eb69869e1a
  • alt-php70-php-fpm_7.0.33-135_amd64.deb
    sha:77d47e47136ad6e10530e85fe0cf02f7c2dadd85
  • alt-php70-process_7.0.33-135_amd64.deb
    sha:2c09d1bafcf8e2d8f49639d758c9e8c7efc9aba3
  • alt-php70-pspell_7.0.33-135_amd64.deb
    sha:2ce78e8a602e79f3a615f041658f0ed9717f9a87
  • alt-php70-recode_7.0.33-135_amd64.deb
    sha:a7151bdcd3106eecd6c57f80aafc895ce3d168f5
  • alt-php70-snmp_7.0.33-135_amd64.deb
    sha:22d669764ed435690bd21c6191f7311cdc07348e
  • alt-php70-soap_7.0.33-135_amd64.deb
    sha:9341f45b90b2202e1302e4c9a567ba3f8dbaa70d
  • alt-php70-tidy_7.0.33-135_amd64.deb
    sha:4f9062b921886390a54f0bc970d2b62c4bb38c09
  • alt-php70-xml_7.0.33-135_amd64.deb
    sha:d98b1da5dbf211d328c3cf45ac9db98068bb6502
  • alt-php70-xmlrpc_7.0.33-135_amd64.deb
    sha:f36d943ae5f0975df11a289df1c949dcc27cfaf9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.