[CLSA-2026:1784567228] alt-php72: Fix of CVE-2026-14355
Type:
security
Severity:
Important
Release date:
2026-07-20 17:07:40 UTC
Description:
- CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers; the output buffer was sized as data_len + one block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and corrupts the zend heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE.
CVEs fixed:
Updated packages:
  • alt-php72-7.2.34-84.el10.x86_64.rpm
    sha:0cba897529654e5f926fea9645a6172bd94d25ebbd057a94c9efd8763971c6a0
  • alt-php72-bcmath-7.2.34-84.el10.x86_64.rpm
    sha:ed11c325d2233f4a3397748679a9399a88bc1c05eb8bc0a1673890201f38a416
  • alt-php72-cli-7.2.34-84.el10.x86_64.rpm
    sha:69e23356e2e1df478a56db942a63ead89b6b07207b25c45e5f719afee50a2995
  • alt-php72-common-7.2.34-84.el10.x86_64.rpm
    sha:862a915ebd9ac017f2f2474844548520432aeb4c7107c95f592a14395232a388
  • alt-php72-dba-7.2.34-84.el10.x86_64.rpm
    sha:51ccd5b732c422cd6532ae11b55b7d229f3eb050859f308fce44c12120b072b3
  • alt-php72-devel-7.2.34-84.el10.x86_64.rpm
    sha:a997114ba8ab3fffc4c38f780496cef9f391eda6dbee43007831b2521b83a498
  • alt-php72-enchant-7.2.34-84.el10.x86_64.rpm
    sha:e1d70084aa3fcd7411a3e2a986f985bf3c692c57bc04ec3f39dc89cdb4a37b15
  • alt-php72-firebird-7.2.34-84.el10.x86_64.rpm
    sha:df20cc0ecca64a5ada2192fe21b2852f5ef2fba16d720c7e2734000d714e08b6
  • alt-php72-gd-7.2.34-84.el10.x86_64.rpm
    sha:9b6529bf1e619b4eb5a813017a691c43fcfa56c3ad5e964c925d0819493c843e
  • alt-php72-imap-7.2.34-84.el10.x86_64.rpm
    sha:f54c844d5a5b658cd91f7276d3f47d3f2c5de4a4f32bbbce54eaa15dd9bafdd1
  • alt-php72-intl-7.2.34-84.el10.x86_64.rpm
    sha:7fa27d48cdb0cc997bea0e887a2069d3df36a7146be8f50e4181c6278d43f2c5
  • alt-php72-ldap-7.2.34-84.el10.x86_64.rpm
    sha:2fcf962b3b213fc063f85f954748a403afa2f435474ea2cda815ced5cf16b644
  • alt-php72-mbstring-7.2.34-84.el10.x86_64.rpm
    sha:0b99434fdf4d5564c955aaa37530393dfb0d0ddc2edf65fe18b66008fbd87325
  • alt-php72-mysqlnd-7.2.34-84.el10.x86_64.rpm
    sha:09beaef2ad5bd95ab875357224b8bb5b4c79c654726cc6de41537c8af1e1040e
  • alt-php72-odbc-7.2.34-84.el10.x86_64.rpm
    sha:542fafe2ae01d703024d99624fc403d5500c7214b9cb714cef72e471703e6eef
  • alt-php72-opcache-7.2.34-84.el10.x86_64.rpm
    sha:e350ac57006fa96102c8fd6a06937c151c0996633d84149836407569a58fcd0d
  • alt-php72-pdo-7.2.34-84.el10.x86_64.rpm
    sha:4e86d23a695af8540573b867c7ca28dd3f21c653fa422c348af3764066191d2f
  • alt-php72-pgsql-7.2.34-84.el10.x86_64.rpm
    sha:1e1ede9d9aa8221e69a32cc6b18b4417944dea290c56bb07bd2a2f5a608ef419
  • alt-php72-php-fpm-7.2.34-84.el10.x86_64.rpm
    sha:501e1482b124b3198a02d94e93d1ade95e470d79e2779090eb817425675c6aa1
  • alt-php72-process-7.2.34-84.el10.x86_64.rpm
    sha:979a81dc7509818928dfbfad7da6e1262bbca8dae8ee65b94cfcbc7d2447b4dc
  • alt-php72-pspell-7.2.34-84.el10.x86_64.rpm
    sha:97832f56f3a8c7b544282dca68af56553feebdfd4edfbe814183bcab8f4bb863
  • alt-php72-recode-7.2.34-84.el10.x86_64.rpm
    sha:2ddee0b99380abcb0a1ccba4e9aea0f2be05455984c763a558d08980c3673581
  • alt-php72-snmp-7.2.34-84.el10.x86_64.rpm
    sha:92b8e5a04ad6482cdd92797b565328e11c3a0110a0b4bb4de8f31a9f32bb0251
  • alt-php72-soap-7.2.34-84.el10.x86_64.rpm
    sha:4325acfc40b241a544c2324fd7f7b3f86f3b0d33e6cb297043bc0e77c002e8b2
  • alt-php72-sodium-7.2.34-84.el10.x86_64.rpm
    sha:aa11ac772f1e13b31aa8d44bfcc7c183fa3bc5a8b5c688f625e9189cf32975f6
  • alt-php72-tidy-7.2.34-84.el10.x86_64.rpm
    sha:e47b321233d09bb8345157b1c2caf721cf124f202ad0ce2e21279e541ce98e6c
  • alt-php72-xml-7.2.34-84.el10.x86_64.rpm
    sha:cfae6028eb6e12da6d106b32aff51a28512a17f65ea149284b19b99da0b70852
  • alt-php72-xmlrpc-7.2.34-84.el10.x86_64.rpm
    sha:6f01879b968bd29dbfb8e41cf57ef33b819f922e9db10193d15023c12e709685
  • alt-php72-zts-7.2.34-84.el10.x86_64.rpm
    sha:6048bc122fa4fe268ce3a286d00507d03e23a63f502a0ba189878845056f4f8d
  • alt-php72-zts-devel-7.2.34-84.el10.x86_64.rpm
    sha:8f4ee6ebe32e002f41e2ba9de99c2e08d09becf54db462be311b3f190635490a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.