Release date:
2026-07-20 12:54:25 UTC
Description:
* SECURITY UPDATE: openssl_encrypt() heap buffer overflow with AES
key-wrap-with-padding (aes-*-wrap-pad) ciphers
- debian/patches/php-5.6-CVE-2026-14355.patch: backport upstream commit
cbc0489126 (GH-22187) in ext/openssl/openssl.c — the output buffer was
sized as data_len + one cipher block, which under-sizes the RFC 5649
padded-wrap output (roundup(len,8)+8) and overflows the heap when built
against OpenSSL 3.x. Reserve one extra block for EVP_CIPH_WRAP_MODE
ciphers.
- Note: upstream (PHP 8.x) sizes the buffer in the shared helper
php_openssl_cipher_update(), which does not exist in 5.6. The fix is
transposed to the inline allocations in both openssl_encrypt() (the
exploitable path) and openssl_decrypt(), guarded by #ifdef
EVP_CIPH_WRAP_MODE for older OpenSSL.
- CVE-2026-14355
Updated packages:
-
alt-php56_5.6.40-133_amd64.deb
sha:93c210b209446b93d812d55df40d7747b2fd6c3e
-
alt-php56-bcmath_5.6.40-133_amd64.deb
sha:3489f96668611706dd165b4d92755d053a5a0a06
-
alt-php56-cli_5.6.40-133_amd64.deb
sha:6e4b361b2cc32efff13446c27514d4396d7d468e
-
alt-php56-common_5.6.40-133_amd64.deb
sha:d84d7949083482fb564083fa41909038d565ebd3
-
alt-php56-dba_5.6.40-133_amd64.deb
sha:9f8ccb5488a0139a6a4bd0c2effc49a4242fe088
-
alt-php56-dbx_5.6.40-133_amd64.deb
sha:51da55d39b85032d34c7fd5585064c1017a8d213
-
alt-php56-dev_5.6.40-133_amd64.deb
sha:072fd5bbdbbf6b6e54e5a9b294fc1311e6fe9119
-
alt-php56-enchant_5.6.40-133_amd64.deb
sha:c4662b21ef879d3468dc6d7c963f3c58eb2d78a9
-
alt-php56-firebird_5.6.40-133_amd64.deb
sha:5143625a16645143cb0bdf320a882a3a11e9c65a
-
alt-php56-gd_5.6.40-133_amd64.deb
sha:c945a7dd29874551af3bdfa9a09be439d86e3c5d
-
alt-php56-imap_5.6.40-133_amd64.deb
sha:72505e9863088aa2c8ee537ed86555addb119942
-
alt-php56-intl_5.6.40-133_amd64.deb
sha:50dab4463771d8229918ae82bf8465c217ed80ed
-
alt-php56-ldap_5.6.40-133_amd64.deb
sha:aedeff5a375e5f200ac174bd612f95782e7013f4
-
alt-php56-mbstring_5.6.40-133_amd64.deb
sha:a8551271b35d580887d5bb2d846e6778412d47a4
-
alt-php56-mcrypt_5.6.40-133_amd64.deb
sha:ca8b7d1361e4e59d121afc72bd3eb047906427aa
-
alt-php56-mysqlnd_5.6.40-133_amd64.deb
sha:ec820141d77c06f97b25e99972407b1cb886d80e
-
alt-php56-odbc_5.6.40-133_amd64.deb
sha:268330fe4e27dbe39476dc01b8b8c4083b0a136c
-
alt-php56-opcache_5.6.40-133_amd64.deb
sha:040cb11ce44958e5421daf0b03ec041ef8d0b9a0
-
alt-php56-pdo_5.6.40-133_amd64.deb
sha:bb62130b98c41a774614baec9f605852638805ac
-
alt-php56-pgsql_5.6.40-133_amd64.deb
sha:db0b88b654c8687c670cd1788ab8e269ade01f8b
-
alt-php56-php-fpm_5.6.40-133_amd64.deb
sha:ed0f1e99e1480f17c6b3bb420d8829f9d8a1bc8e
-
alt-php56-process_5.6.40-133_amd64.deb
sha:f96e6c3721ba93fe15ffbbc77e1b3c7a4b133a68
-
alt-php56-pspell_5.6.40-133_amd64.deb
sha:e203f8bd07d435edb59533b23a8d608202aabdd3
-
alt-php56-recode_5.6.40-133_amd64.deb
sha:820ee3ae88b5820bbdf53358c231c55393ec1fdb
-
alt-php56-snmp_5.6.40-133_amd64.deb
sha:a7da34e489c67ffa85f6eebae06cc7e8876323f8
-
alt-php56-soap_5.6.40-133_amd64.deb
sha:c68a618d9087717027d8dc0d1b5508ffee7a490c
-
alt-php56-sybase_5.6.40-133_amd64.deb
sha:3838bfa164f7a8fdad6c89e2412a3167d3b5cbf0
-
alt-php56-tidy_5.6.40-133_amd64.deb
sha:5c37047cf3e144b6441a5ed256de8af99c022fbb
-
alt-php56-xml_5.6.40-133_amd64.deb
sha:c035c3640557244283c0baf09b5f3c8ff68de98b
-
alt-php56-xmlrpc_5.6.40-133_amd64.deb
sha:3513bd45cd32df750280e9ea876cdc6a8c18bd7a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
