[CLSA-2026:1784049375] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-14 17:16:30 UTC
Description:
* CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with AES key-wrap-pad (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + EVP_CIPHER_block_size, which under-sizes RFC 5649 padded-wrap output and overflows the heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream php-src cbc0489126a7682796aad1e5fb4e51de74af162c).
CVEs fixed:
Updated packages:
  • alt-php70_7.0.33-135_amd64.deb
    sha:a124150ab963de49817ad206b3840958b9cc2034
  • alt-php70-bcmath_7.0.33-135_amd64.deb
    sha:329af815eb643902be9f2f37f2d882e46286547f
  • alt-php70-cli_7.0.33-135_amd64.deb
    sha:39abf357c579b543564678fad4d298323ed599a6
  • alt-php70-common_7.0.33-135_amd64.deb
    sha:e1a99d772001edbe816be460bc984344048f45bc
  • alt-php70-dba_7.0.33-135_amd64.deb
    sha:d1edbee8f9908836ad5854b12c53fe5fdd3eb976
  • alt-php70-dev_7.0.33-135_amd64.deb
    sha:90d47d4975d8810c60b34c473024c0a042f81a50
  • alt-php70-enchant_7.0.33-135_amd64.deb
    sha:cbdeab16d75011491fc95fe7ae61cf58e876ed3f
  • alt-php70-firebird_7.0.33-135_amd64.deb
    sha:8eec19df95ed087af93d8ee57af995133405e638
  • alt-php70-gd_7.0.33-135_amd64.deb
    sha:5efdc96833a6e46c3b35a20ae325f45b75cc7e27
  • alt-php70-imap_7.0.33-135_amd64.deb
    sha:bf81119203dccb2aa29412db410a60b43489c0d2
  • alt-php70-intl_7.0.33-135_amd64.deb
    sha:8d3406b973ea9ba6a8cf0a1ca58b2eddf52cb5f6
  • alt-php70-ldap_7.0.33-135_amd64.deb
    sha:dbeb4c8fc7178bfc6b9b08ddfb70f8419b1b9b84
  • alt-php70-mbstring_7.0.33-135_amd64.deb
    sha:79791976662b4a6009214023c74e12ad2a1edd5c
  • alt-php70-mcrypt_7.0.33-135_amd64.deb
    sha:8a11ad95676a541a379432f6c46583146c8acab8
  • alt-php70-mysqlnd_7.0.33-135_amd64.deb
    sha:9bd0a6f768dcd924f2a9081a8b12dea0056593ad
  • alt-php70-odbc_7.0.33-135_amd64.deb
    sha:ce6292fe67fafce51114cee521eb83344b26bc3f
  • alt-php70-opcache_7.0.33-135_amd64.deb
    sha:4bcbd49c6b9497da34c5506a4632a56f6bb908a5
  • alt-php70-pdo_7.0.33-135_amd64.deb
    sha:7dadec0cd1ae5c5f5e070e648b05481bbbd301c3
  • alt-php70-pgsql_7.0.33-135_amd64.deb
    sha:7b27f85d23a1e37a4ae71f6bc759de7dcca544ba
  • alt-php70-php-fpm_7.0.33-135_amd64.deb
    sha:521e810d769bbf7431d51296cee3f6ba87feb378
  • alt-php70-process_7.0.33-135_amd64.deb
    sha:9b065bb12b0ee7af6a24fea2ccae9b97496eecef
  • alt-php70-pspell_7.0.33-135_amd64.deb
    sha:04d1a2328cf99f99ad7b3344e77acb021de4aafc
  • alt-php70-recode_7.0.33-135_amd64.deb
    sha:9a00b4a8a19f73ca0e293453bb5c57097933e129
  • alt-php70-snmp_7.0.33-135_amd64.deb
    sha:849d4c5a19b2c2b0330566887d6f167a55b1b510
  • alt-php70-soap_7.0.33-135_amd64.deb
    sha:3eb185ddc440d18362225c183165ccd6fb0a60b0
  • alt-php70-tidy_7.0.33-135_amd64.deb
    sha:ff6aab848fa16b57f9344f3b6dc0cd19d172ca51
  • alt-php70-xml_7.0.33-135_amd64.deb
    sha:fbfb43bccd0cd831edb8e04a5be2a4e6548e1fca
  • alt-php70-xmlrpc_7.0.33-135_amd64.deb
    sha:0728f57096749e45695f7b4e7831aa84600bff4d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.