[CLSA-2026:1784047663] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-14 16:48:01 UTC
Description:
* CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with AES key-wrap-pad (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + EVP_CIPHER_block_size, which under-sizes RFC 5649 padded-wrap output and overflows the heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream php-src cbc0489126a7682796aad1e5fb4e51de74af162c).
CVEs fixed:
Updated packages:
  • alt-php70_7.0.33-135_amd64.deb
    sha:192bdc6da6b38c7f87f53aef9e2067cadb334560
  • alt-php70-bcmath_7.0.33-135_amd64.deb
    sha:25214b0fe11d8898bc752a577cf49f6390e0ef84
  • alt-php70-cli_7.0.33-135_amd64.deb
    sha:36bfe0bbb9a244ff36d0e189e49b40fde8aecfaa
  • alt-php70-common_7.0.33-135_amd64.deb
    sha:54dc9aae86ed520bea410decff4c677b1cb4f938
  • alt-php70-dba_7.0.33-135_amd64.deb
    sha:f19fab8c919a15b54c3d319c9275a3321fdeb086
  • alt-php70-dev_7.0.33-135_amd64.deb
    sha:3e1ac516a7dadd6813d40fb91e9e0a9f6bd268fd
  • alt-php70-enchant_7.0.33-135_amd64.deb
    sha:205ebceac185072ac1070e64b60b5ed4bb51b6f8
  • alt-php70-firebird_7.0.33-135_amd64.deb
    sha:be7ee7c998a6af52c1320e1a8c2953e9b34dacdc
  • alt-php70-gd_7.0.33-135_amd64.deb
    sha:0f9a3882481de0706a0761ed43d329ebbf591df8
  • alt-php70-imap_7.0.33-135_amd64.deb
    sha:f9a2e02880c50f1b91d0e31bbbf40f5db9652bec
  • alt-php70-intl_7.0.33-135_amd64.deb
    sha:ece5f826d6d2e5c17219e0a72c8d44dd4ca14355
  • alt-php70-ldap_7.0.33-135_amd64.deb
    sha:bc232ba1c542c17f5201a32a8c9f365e6c0cb240
  • alt-php70-mbstring_7.0.33-135_amd64.deb
    sha:a76387a46803facc295ef92ff2eee28bf156cff3
  • alt-php70-mcrypt_7.0.33-135_amd64.deb
    sha:2b75d4db74fb6c53a11cbebe50687a1f1539ad2e
  • alt-php70-mysqlnd_7.0.33-135_amd64.deb
    sha:4cdf1967b8d87da2664044b9faad39dbf83b30a5
  • alt-php70-odbc_7.0.33-135_amd64.deb
    sha:3e3778ea41b2c2f3365aacdb32374b491d25bb72
  • alt-php70-opcache_7.0.33-135_amd64.deb
    sha:b1245e0fbd4710075ab0cf855f6e4408021c0423
  • alt-php70-pdo_7.0.33-135_amd64.deb
    sha:04dea0252393e5eab49e6e2e4beead97916ed604
  • alt-php70-pgsql_7.0.33-135_amd64.deb
    sha:1e93f8b99373ad2b6a0fee44beb812b6e247d10c
  • alt-php70-php-fpm_7.0.33-135_amd64.deb
    sha:7dd01b09681cd40f2c5cf5b4639b571ebaa9f86b
  • alt-php70-process_7.0.33-135_amd64.deb
    sha:0796325816aa2d1987b334a674e574ac41b79182
  • alt-php70-pspell_7.0.33-135_amd64.deb
    sha:2e8f18ba2082bab4ce47ef445ed7f8335af1dbe7
  • alt-php70-recode_7.0.33-135_amd64.deb
    sha:a133b8f59b178cf1b0f9918ae3527a231dd2e88b
  • alt-php70-snmp_7.0.33-135_amd64.deb
    sha:f4db44d340265c7314e31fffb9d24c3e9a461878
  • alt-php70-soap_7.0.33-135_amd64.deb
    sha:59a8e4309e4b02b2c8e5e3c3c7f5a68281c573b9
  • alt-php70-tidy_7.0.33-135_amd64.deb
    sha:ec29665eb55507862d0c67d979a7611a430028bc
  • alt-php70-xml_7.0.33-135_amd64.deb
    sha:d2fe489aa5436fdacd79517cf75b6f933a045553
  • alt-php70-xmlrpc_7.0.33-135_amd64.deb
    sha:71429ec2b4c6665c6fcfea44481f897faf18b49a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.