Release date:
2026-07-20 08:17:31 UTC
Description:
* SECURITY UPDATE: openssl_encrypt() heap buffer overflow with AES
key-wrap-with-padding (aes-*-wrap-pad) ciphers
- debian/patches/php-5.6-CVE-2026-14355.patch: backport upstream commit
cbc0489126 (GH-22187) in ext/openssl/openssl.c — the output buffer was
sized as data_len + one cipher block, which under-sizes the RFC 5649
padded-wrap output (roundup(len,8)+8) and overflows the heap when built
against OpenSSL 3.x. Reserve one extra block for EVP_CIPH_WRAP_MODE
ciphers.
- Note: upstream (PHP 8.x) sizes the buffer in the shared helper
php_openssl_cipher_update(), which does not exist in 5.6. The fix is
transposed to the inline allocations in both openssl_encrypt() (the
exploitable path) and openssl_decrypt(), guarded by #ifdef
EVP_CIPH_WRAP_MODE for older OpenSSL.
- CVE-2026-14355
Updated packages:
-
alt-php56_5.6.40-133_amd64.deb
sha:8568580b753ccc9c650d7470cd6b868b21433f89
-
alt-php56-bcmath_5.6.40-133_amd64.deb
sha:590cc0611be707bd2dde5f7ab66b1b8114504190
-
alt-php56-cli_5.6.40-133_amd64.deb
sha:24ff9f337c93558d203232e6344a3e308caec733
-
alt-php56-common_5.6.40-133_amd64.deb
sha:e7d10f62103b7392ab078944609a821028e1695b
-
alt-php56-dba_5.6.40-133_amd64.deb
sha:ea717bfe7968285ab17b1d45e53a80f173e552c9
-
alt-php56-dbx_5.6.40-133_amd64.deb
sha:7255985033b3dd05d7c0594a6973ba951c9c35bf
-
alt-php56-dev_5.6.40-133_amd64.deb
sha:926516439ef47ee8af6bd3ef8b0d7b61eb8c107a
-
alt-php56-enchant_5.6.40-133_amd64.deb
sha:51f0bb1d356a81d28094b1bdf50f458f62abbb38
-
alt-php56-firebird_5.6.40-133_amd64.deb
sha:22d9a4f7c20c5de534d62b1182c0c21c0333048f
-
alt-php56-gd_5.6.40-133_amd64.deb
sha:99cc8721559545f6f442db5cfaffa1be0d2b86ea
-
alt-php56-imap_5.6.40-133_amd64.deb
sha:19c89b8aeb730de8de642fe38c32b0b29fdf3e36
-
alt-php56-intl_5.6.40-133_amd64.deb
sha:e909b19626a2b371338c8c6d3d056f91d13a0c3b
-
alt-php56-ldap_5.6.40-133_amd64.deb
sha:125f82c2c565ba5ae9f5cfd8a77620fdd18d958c
-
alt-php56-mbstring_5.6.40-133_amd64.deb
sha:f6e6c761b34bc583b74cf0d9f2e634a1b2d1c345
-
alt-php56-mcrypt_5.6.40-133_amd64.deb
sha:f94a63d2334927bb99d33312a08738963d47249d
-
alt-php56-mysqlnd_5.6.40-133_amd64.deb
sha:cfdb93bfc8ff61caff75cdb1a7367fe3dc2145cc
-
alt-php56-odbc_5.6.40-133_amd64.deb
sha:0bead387cfb63011c31635999e2b277c22868264
-
alt-php56-opcache_5.6.40-133_amd64.deb
sha:20245ed1819f969b57ade62cf0baa661c5a0fd57
-
alt-php56-pdo_5.6.40-133_amd64.deb
sha:257f41262e1e5d782bca971ffc8b0637e65a694e
-
alt-php56-pgsql_5.6.40-133_amd64.deb
sha:4cb5f94a38b9f3980463d3d444614ea74547b083
-
alt-php56-php-fpm_5.6.40-133_amd64.deb
sha:5cf70ea44e569975f81299449d1a9c2a8787df68
-
alt-php56-process_5.6.40-133_amd64.deb
sha:98e3fd2f5d5467b906d7f25e72cd3ab6aa411ddb
-
alt-php56-pspell_5.6.40-133_amd64.deb
sha:35799a38e8720282257c663811e59aa7a19830e3
-
alt-php56-recode_5.6.40-133_amd64.deb
sha:7243ecc5d4582c4e59d951ec5a530f0b0aa9b1a2
-
alt-php56-snmp_5.6.40-133_amd64.deb
sha:8d37a2d1dd4102577a96d2c6c57d70f97ce6ebfa
-
alt-php56-soap_5.6.40-133_amd64.deb
sha:91f53759bf260c322a93ec22ace3e9e7e9fc64c3
-
alt-php56-sybase_5.6.40-133_amd64.deb
sha:69a190b64c21089fdf5399259f53ca1f28b2dd83
-
alt-php56-tidy_5.6.40-133_amd64.deb
sha:a7d39dda29ffadfda38a6ee5c36cf67fb7770270
-
alt-php56-xml_5.6.40-133_amd64.deb
sha:6e2c3c45218648ad1610ef0da28c0cd7d6afb9ea
-
alt-php56-xmlrpc_5.6.40-133_amd64.deb
sha:5fa01a4e1fb7d1428404196ab7d5e5ee2dd19cec
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
