Release date:
2026-07-20 09:46:09 UTC
Description:
* SECURITY UPDATE: openssl_encrypt() heap buffer overflow with AES
key-wrap-with-padding (aes-*-wrap-pad) ciphers
- debian/patches/php-5.6-CVE-2026-14355.patch: backport upstream commit
cbc0489126 (GH-22187) in ext/openssl/openssl.c — the output buffer was
sized as data_len + one cipher block, which under-sizes the RFC 5649
padded-wrap output (roundup(len,8)+8) and overflows the heap when built
against OpenSSL 3.x. Reserve one extra block for EVP_CIPH_WRAP_MODE
ciphers.
- Note: upstream (PHP 8.x) sizes the buffer in the shared helper
php_openssl_cipher_update(), which does not exist in 5.6. The fix is
transposed to the inline allocations in both openssl_encrypt() (the
exploitable path) and openssl_decrypt(), guarded by #ifdef
EVP_CIPH_WRAP_MODE for older OpenSSL.
- CVE-2026-14355
Updated packages:
-
alt-php56_5.6.40-133_amd64.deb
sha:1a6f9e3a45aeeb5b2702c07e5c7c524677fcfca7
-
alt-php56-bcmath_5.6.40-133_amd64.deb
sha:74cd97cc53f45c0d486f796ac57b45d46d26ace9
-
alt-php56-cli_5.6.40-133_amd64.deb
sha:b2b05f8e750c5f590322a0483a185fc71c34ab1a
-
alt-php56-common_5.6.40-133_amd64.deb
sha:e5d53d21ff36b4f6cacac74153a98d061056286d
-
alt-php56-dba_5.6.40-133_amd64.deb
sha:2f7ebaaa65de919382883e35fd4494072ab06df0
-
alt-php56-dbx_5.6.40-133_amd64.deb
sha:d8baa0b65044b6922fe2998e3bf527cd6b13fdd2
-
alt-php56-dev_5.6.40-133_amd64.deb
sha:3f76ae9b67344527e08957751775b182eb065109
-
alt-php56-enchant_5.6.40-133_amd64.deb
sha:690b654fdb033d79fa78f19699842945ae5c9e5a
-
alt-php56-firebird_5.6.40-133_amd64.deb
sha:239d724cd019a68baaa1e612f3e6fa86e84f2d9c
-
alt-php56-gd_5.6.40-133_amd64.deb
sha:dcdf3af30e638cb824499b5dd7ba1fa78f870c20
-
alt-php56-imap_5.6.40-133_amd64.deb
sha:8657144c72f126423944344861b9ce7aa2ee73dc
-
alt-php56-intl_5.6.40-133_amd64.deb
sha:c203ba6ac99430f742609009bd26414e2ba60749
-
alt-php56-ldap_5.6.40-133_amd64.deb
sha:011750e2e12f215f4a5679779b264079157b448f
-
alt-php56-mbstring_5.6.40-133_amd64.deb
sha:d1bdb637163bfe1c9b5abf6003166e08d2e64212
-
alt-php56-mcrypt_5.6.40-133_amd64.deb
sha:8a1d7441c3df15007b0800bd11e01b2b9b2bfdf1
-
alt-php56-mysqlnd_5.6.40-133_amd64.deb
sha:efc91093006c5d372ae889e7b1e038d3d6916314
-
alt-php56-odbc_5.6.40-133_amd64.deb
sha:160d80e33bfad8d56dd896a5bcf947c94a7d5bc6
-
alt-php56-opcache_5.6.40-133_amd64.deb
sha:1a1b226b4bcfbf27311abd2a9962da6313a9a80c
-
alt-php56-pdo_5.6.40-133_amd64.deb
sha:b56716b52e2afba188f77ec3d33ebbb5f18be330
-
alt-php56-pgsql_5.6.40-133_amd64.deb
sha:2099383338a46422928bdb74c52edf7ed905fc7e
-
alt-php56-php-fpm_5.6.40-133_amd64.deb
sha:e78eb49df868b348c969be4b75bad8e8962a80cd
-
alt-php56-process_5.6.40-133_amd64.deb
sha:3eccf66c86ab2257eed4722b6c52ac3ae1fecd2b
-
alt-php56-pspell_5.6.40-133_amd64.deb
sha:c03ce13e6c2d0e2f74c44ba13f59232502bbfe4f
-
alt-php56-recode_5.6.40-133_amd64.deb
sha:2e7048e7089eb0f95579d13cb004c575d79bb73e
-
alt-php56-snmp_5.6.40-133_amd64.deb
sha:1723acd2fe1720f0d6e25df6257a0fc45e0ec735
-
alt-php56-soap_5.6.40-133_amd64.deb
sha:646a92babeeae8fe303059320d04bf5d34f58237
-
alt-php56-sybase_5.6.40-133_amd64.deb
sha:e88fb79a0400fcc851566a2a6245ac5f90af5a3b
-
alt-php56-tidy_5.6.40-133_amd64.deb
sha:cc8943b768044dd69a926f38fa1080ba49f06710
-
alt-php56-xml_5.6.40-133_amd64.deb
sha:5b3e645c89aad4750f0f1d0954a2c440a1c1342c
-
alt-php56-xmlrpc_5.6.40-133_amd64.deb
sha:f1c6a21b0fbdf0fcddcb12b0bb7e784d7f5e63e7
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
