Release date:
2026-07-20 09:54:15 UTC
Description:
* SECURITY UPDATE: openssl_encrypt() heap buffer overflow with AES
key-wrap-with-padding (aes-*-wrap-pad) ciphers
- debian/patches/php-5.6-CVE-2026-14355.patch: backport upstream commit
cbc0489126 (GH-22187) in ext/openssl/openssl.c — the output buffer was
sized as data_len + one cipher block, which under-sizes the RFC 5649
padded-wrap output (roundup(len,8)+8) and overflows the heap when built
against OpenSSL 3.x. Reserve one extra block for EVP_CIPH_WRAP_MODE
ciphers.
- Note: upstream (PHP 8.x) sizes the buffer in the shared helper
php_openssl_cipher_update(), which does not exist in 5.6. The fix is
transposed to the inline allocations in both openssl_encrypt() (the
exploitable path) and openssl_decrypt(), guarded by #ifdef
EVP_CIPH_WRAP_MODE for older OpenSSL.
- CVE-2026-14355
Updated packages:
-
alt-php56_5.6.40-133_amd64.deb
sha:93c210b209446b93d812d55df40d7747b2fd6c3e
-
alt-php56-bcmath_5.6.40-133_amd64.deb
sha:1e3eecb9576d3cb38b4fd99322e139e001c78485
-
alt-php56-cli_5.6.40-133_amd64.deb
sha:8a448171b3db52d03db00fbf799421dbec79665a
-
alt-php56-common_5.6.40-133_amd64.deb
sha:8209fa027cbf65f7cd47e9f2ac89725b15f8043d
-
alt-php56-dba_5.6.40-133_amd64.deb
sha:b8920d03283b5c49d604323d5ba8fddfc71dbd25
-
alt-php56-dbx_5.6.40-133_amd64.deb
sha:3ab91be3e26808784e76233866d8f1136059e214
-
alt-php56-dev_5.6.40-133_amd64.deb
sha:fdea8698df7c93f3416937b98fb7f9648c05dfac
-
alt-php56-enchant_5.6.40-133_amd64.deb
sha:d2284be70c8c14d09cdbfe19146852c6b51480cc
-
alt-php56-firebird_5.6.40-133_amd64.deb
sha:abd9ce77deb7077d248c00c6d398440054f7b27c
-
alt-php56-gd_5.6.40-133_amd64.deb
sha:bf4d66d2db6421fd5665a086640a484757ce24f8
-
alt-php56-imap_5.6.40-133_amd64.deb
sha:eb041eb32bce32df986de7a5cb2b063dc83fc6d1
-
alt-php56-intl_5.6.40-133_amd64.deb
sha:3eeadef6d1e8a6224c1a0c1a7a0f3f02c91b11d2
-
alt-php56-ldap_5.6.40-133_amd64.deb
sha:72e4a2a9d690fef42da7f44313f44d227ad23d0c
-
alt-php56-mbstring_5.6.40-133_amd64.deb
sha:23c9dc2e71122f06cd28104330557b1ed985a6ae
-
alt-php56-mcrypt_5.6.40-133_amd64.deb
sha:53aa231b74d6ae759ab2f0faaeebf036751b43db
-
alt-php56-mysqlnd_5.6.40-133_amd64.deb
sha:474176311b0146f38dc856a37c31e9095f01ed34
-
alt-php56-odbc_5.6.40-133_amd64.deb
sha:57cc91c0d083cd3ba39e711865ffeacb787aafc7
-
alt-php56-opcache_5.6.40-133_amd64.deb
sha:95442d0ca261fdfd228ca433636ba1a2d1da5087
-
alt-php56-pdo_5.6.40-133_amd64.deb
sha:5a791b7cebe1b4c831a6fe443dcc7229c3130c24
-
alt-php56-pgsql_5.6.40-133_amd64.deb
sha:fb6da124e715a65e2cbe3fb1f076420853356f8a
-
alt-php56-php-fpm_5.6.40-133_amd64.deb
sha:73d9c9a24942321405435ccd19b9a141e7861db7
-
alt-php56-process_5.6.40-133_amd64.deb
sha:6241629a8e117a698c1f23ff5adf6c29e6a56753
-
alt-php56-pspell_5.6.40-133_amd64.deb
sha:7db598b1414cf3a11cc12b0ed4282756fc9e29ae
-
alt-php56-recode_5.6.40-133_amd64.deb
sha:6a228d0efaf8c80e4df342f66d5ee36b2c52709c
-
alt-php56-snmp_5.6.40-133_amd64.deb
sha:95f785b414b24d70ee900d001d105da9dd5f0a6f
-
alt-php56-soap_5.6.40-133_amd64.deb
sha:d3abda722d86a7679171e1dd2e811c975c52f725
-
alt-php56-sybase_5.6.40-133_amd64.deb
sha:809bb89a808290f2e92390b9f0dd7880c0a25a4f
-
alt-php56-tidy_5.6.40-133_amd64.deb
sha:a1ed47960304703b2fee5fbac1fca19210712e96
-
alt-php56-xml_5.6.40-133_amd64.deb
sha:3bbcf8e0cdda8a3b821b7c641a8075cc9e153bb3
-
alt-php56-xmlrpc_5.6.40-133_amd64.deb
sha:3280cb19d33e5cedea6e52c8a31073e2e5a601ee
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
