[CLSA-2026:1784532616] Fix CVE(s): CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-20 07:30:38 UTC
Description:
* CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + one block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and corrupts the zend heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE.
CVEs fixed:
Updated packages:
  • alt-php72_7.2.34-84_amd64.deb
    sha:bb39cb704877132e754a31ed99ce1015faa8bb1e
  • alt-php72-bcmath_7.2.34-84_amd64.deb
    sha:588788bc2c7ffac0198e2d61564d20d75be5e47e
  • alt-php72-cli_7.2.34-84_amd64.deb
    sha:6148e54a5dbb27270c87d38154a5889ffb94ae50
  • alt-php72-common_7.2.34-84_amd64.deb
    sha:111fa07bbd83bd4965fc36703c04d2dde232af0c
  • alt-php72-dba_7.2.34-84_amd64.deb
    sha:5332e5a7c56b8ab6dc06e7f826f012bf08800498
  • alt-php72-dev_7.2.34-84_amd64.deb
    sha:3b030928b6f80095ef34f91b0989bc349893b1be
  • alt-php72-enchant_7.2.34-84_amd64.deb
    sha:846fab7098acc67b2c9c7f621a06711b21c71cd0
  • alt-php72-firebird_7.2.34-84_amd64.deb
    sha:7074f142696c2c181dd6f6b2c54d8fea87ff243b
  • alt-php72-gd_7.2.34-84_amd64.deb
    sha:8600481e8cd525096c51f94b9f055505506d815e
  • alt-php72-imap_7.2.34-84_amd64.deb
    sha:60b3c7c3e2e4cde2034ee13e4977ea7418a4477a
  • alt-php72-intl_7.2.34-84_amd64.deb
    sha:b05ae8d1278158654afe2bbe4307e432a4e21a3c
  • alt-php72-ldap_7.2.34-84_amd64.deb
    sha:501dd00d022220e5da1979a71adedff7243df52c
  • alt-php72-mbstring_7.2.34-84_amd64.deb
    sha:43dfb19cce2e4c7a11f7d6e47e68da6c98e18db8
  • alt-php72-mysqlnd_7.2.34-84_amd64.deb
    sha:40e4e74495e759904739a00c8b48287f3f83f5cf
  • alt-php72-odbc_7.2.34-84_amd64.deb
    sha:8329c56eec0e544c92bd8678a46eacca68ad688f
  • alt-php72-opcache_7.2.34-84_amd64.deb
    sha:e36f9e5384347a7603d46622c840c80070cf27c0
  • alt-php72-pdo_7.2.34-84_amd64.deb
    sha:908f156f210576c8b360645942311b13a12f3b47
  • alt-php72-pgsql_7.2.34-84_amd64.deb
    sha:781528594a9dbdb424180445d1e7001c8def1db2
  • alt-php72-php-fpm_7.2.34-84_amd64.deb
    sha:6b57375ca604a9f3e50e2cc1ed2dd25004abc8aa
  • alt-php72-process_7.2.34-84_amd64.deb
    sha:2a2e39a3af9af8bf9c6a3fd27b58cd4c6378d969
  • alt-php72-pspell_7.2.34-84_amd64.deb
    sha:7c3be87a6375598ab1291650a6fe063b39c492b2
  • alt-php72-recode_7.2.34-84_amd64.deb
    sha:904d5a79ad620328a98cf06596cffe3192ae8c59
  • alt-php72-snmp_7.2.34-84_amd64.deb
    sha:1df4b37415d0362d9fe9f1b896e64094884181f5
  • alt-php72-soap_7.2.34-84_amd64.deb
    sha:1280d4690d91ba60478d02baf70ecacb4e5ca008
  • alt-php72-sodium_7.2.34-84_amd64.deb
    sha:16a6f552390acae52ab7100aacaa06941f1cb124
  • alt-php72-tidy_7.2.34-84_amd64.deb
    sha:52ba609a3cccb6f609e989e2ec377be5427129b5
  • alt-php72-xml_7.2.34-84_amd64.deb
    sha:988f7426b614fc6a0d54e4c7c96a1f4d1c50ff7a
  • alt-php72-xmlrpc_7.2.34-84_amd64.deb
    sha:647c9868a3f535d324a83d03dd1f9b77fdeed0d3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.