Release date:
2026-07-20 07:23:20 UTC
Description:
* SECURITY UPDATE: openssl_encrypt() heap buffer overflow with AES
key-wrap-with-padding (aes-*-wrap-pad) ciphers
- debian/patches/php-5.6-CVE-2026-14355.patch: backport upstream commit
cbc0489126 (GH-22187) in ext/openssl/openssl.c — the output buffer was
sized as data_len + one cipher block, which under-sizes the RFC 5649
padded-wrap output (roundup(len,8)+8) and overflows the heap when built
against OpenSSL 3.x. Reserve one extra block for EVP_CIPH_WRAP_MODE
ciphers.
- Note: upstream (PHP 8.x) sizes the buffer in the shared helper
php_openssl_cipher_update(), which does not exist in 5.6. The fix is
transposed to the inline allocations in both openssl_encrypt() (the
exploitable path) and openssl_decrypt(), guarded by #ifdef
EVP_CIPH_WRAP_MODE for older OpenSSL.
- CVE-2026-14355
Updated packages:
-
alt-php56_5.6.40-133_amd64.deb
sha:c93d578f18c34a2447e31a6e44499f39de7819bf
-
alt-php56-bcmath_5.6.40-133_amd64.deb
sha:01bc2c12100daa7787715369e3d47e30ccd0880f
-
alt-php56-cli_5.6.40-133_amd64.deb
sha:392896843a8359ed5dfefba8c7e3351b84e1274f
-
alt-php56-common_5.6.40-133_amd64.deb
sha:a929777b1303e15aa3c3d6eb3dd7972a1480b915
-
alt-php56-dba_5.6.40-133_amd64.deb
sha:f64ee47c725c3594194773d6843d5b8b7855a769
-
alt-php56-dbx_5.6.40-133_amd64.deb
sha:6295606c7c61aef6aeb5e61b54dff49657bd6aa1
-
alt-php56-dev_5.6.40-133_amd64.deb
sha:af89be5fa355d57268e2ef1d7097b8b9c0ff20e8
-
alt-php56-enchant_5.6.40-133_amd64.deb
sha:fff461160653beec46fcb20d98db38729e08cefe
-
alt-php56-firebird_5.6.40-133_amd64.deb
sha:2979bfa2b33caa5ec9b22aa330741d2026d82cfb
-
alt-php56-gd_5.6.40-133_amd64.deb
sha:9632eb00eea434a2b279a032c65cda0ae20b41ca
-
alt-php56-imap_5.6.40-133_amd64.deb
sha:1a20001c332ddfdc4824d4d2a9bee66c41bdd603
-
alt-php56-intl_5.6.40-133_amd64.deb
sha:a79d6cd9164ec80612c4715fd1aed973f1819105
-
alt-php56-ldap_5.6.40-133_amd64.deb
sha:3b6433ef84139e03ac2b055906117114cb393d68
-
alt-php56-mbstring_5.6.40-133_amd64.deb
sha:7f5eba8675a5d08f12917fc96f58c5a3dff7e1cc
-
alt-php56-mcrypt_5.6.40-133_amd64.deb
sha:1de28d7c70f4892f6b7b84405290b73ec5fa8c3f
-
alt-php56-mysqlnd_5.6.40-133_amd64.deb
sha:d805a2ddf6fec644a188693cf8374ba70f236fef
-
alt-php56-odbc_5.6.40-133_amd64.deb
sha:e1f3416cbfadfc91cf952341f77efc9ac012acfd
-
alt-php56-opcache_5.6.40-133_amd64.deb
sha:2b3724965d480ec397db1837e6f24e08afe61120
-
alt-php56-pdo_5.6.40-133_amd64.deb
sha:d38ad87be2abb4205c324aeb319fc786fce61e5c
-
alt-php56-pgsql_5.6.40-133_amd64.deb
sha:9f98b9e6d59df78266388551a7fd216a8bfd6f85
-
alt-php56-php-fpm_5.6.40-133_amd64.deb
sha:7a03f364a98864b951fb5e2c281189ece9f16015
-
alt-php56-process_5.6.40-133_amd64.deb
sha:5f32729e63801721badae8795ebdca90b8410961
-
alt-php56-pspell_5.6.40-133_amd64.deb
sha:fdf5fa58aa4e62dd5c802e6d4cc3c70b56437780
-
alt-php56-recode_5.6.40-133_amd64.deb
sha:3dc1bb303e761411788dab1469c4fb916a1781b8
-
alt-php56-snmp_5.6.40-133_amd64.deb
sha:17d17fb481511d4da14140f4b793c5bf28b6961a
-
alt-php56-soap_5.6.40-133_amd64.deb
sha:64ee31d6edc492f55f251f670ea7a3a3a85e27f2
-
alt-php56-sybase_5.6.40-133_amd64.deb
sha:dede092ce9d56e5437f1ae28220c2016ec7d41d2
-
alt-php56-tidy_5.6.40-133_amd64.deb
sha:bf419392292ff8322cf905d7a278de449d1e3436
-
alt-php56-xml_5.6.40-133_amd64.deb
sha:672a71a57f5c49ed3cecc7437b554298245e987f
-
alt-php56-xmlrpc_5.6.40-133_amd64.deb
sha:52b9dd92b63184a96a00b5dd81b3a9a13e617fc7
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
