Summary
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.
Security Fix(es):
* php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)
Bug Fix(es) and Enhancement(s):
* Rebase PHP to 8.4.23 for CVE-2026-14355 in 10.2.z (JIRA:AlmaLinux-192616)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 25
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | php8.4 | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-bcmath | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-cli | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-common | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-dba | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-dbg | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-devel | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-embedded | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-enchant | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-ffi | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-fpm | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-gd | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-gmp | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-intl | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-ldap | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-mbstring | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-mysqlnd | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-odbc | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-opcache | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-pdo | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-pgsql | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-process | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-snmp | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-soap | 8.4.23-1.el10_2 |
| AlmaLinux · 10 | php8.4-xml | 8.4.23-1.el10_2 |
Vulnerabilities 1
-
Medium 5.6
ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD
In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation …