[CLSA-2026:1790174162] Fix CVE(s): CVE-2014-3622
Type:
security
Severity:
Important
Release date:
2026-09-23 14:36:20 UTC
Description:
* ALTPHP-2571: restore the sticky-writable mode on /opt/alt/php56/var/lib/php/session from the Debian/Ubuntu postinst - dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root user could write session data * ALTEAPLN-3: no change to the Debian packaging - alt-php56-cli has never depended on the FPM package here. Recorded for parity with the RPM side, where a hard Requires was dropped so the FPM package can be removed on servers that only use PHP Selector via lsapi * ALTEAPLN-15: stop shipping the empty /opt/cpanel/alt-php56/root/etc/php-fpm.d/_.conf placeholder in the package. cPanel counts any *.conf in that directory as an enabled FPM pool and kept restarting alt-php56-fpm through chkservd on servers that never use FPM, even with the unit disabled. The alt-php56-php-fpm post-install script now creates the file with mode 0644 only when cPanel is absent - the only case where it is wanted, to silence php-fpm's include-glob warning - and deletes it when cPanel is present. Since no package owns the file any more, a new -php-fpm postrm removes it on remove and purge, so a stray *.conf cannot be left behind to re-trigger this bug if cPanel is installed later The default www pool is removed on cPanel hosts too, the same way as _.conf. cPanel writes its own per-domain pool under /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its API - verified serving a request with SAPI fpm-fcgi from that pool alone - so the shipped default pool was only letting the service run on hosts that never use FPM. It is still shipped and used off cPanel * ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since 7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master with SIGUSR2 and leave the service down * ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no rotate directive, so logrotate applied its default of 0 and deleted the previous log on every rotation, leaving no error-log history at all. Found while adding this config to php53-55, which had none
CVEs fixed:
Updated packages:
  • alt-php56_5.6.40-139_amd64.deb
    sha:5eb60aea978f93c9a0a1f8e9c685e90ca95aea22
  • alt-php56-bcmath_5.6.40-139_amd64.deb
    sha:9a37e53ab07ef1bdef24ccc73a0d52daab3a3a68
  • alt-php56-cli_5.6.40-139_amd64.deb
    sha:894124b2811a8412a8fd7f7f59410039d4145ec5
  • alt-php56-common_5.6.40-139_amd64.deb
    sha:9392bc95091d5cbf06d930a786957f91fa918d5f
  • alt-php56-dba_5.6.40-139_amd64.deb
    sha:bb5cb126ac6ce85e97e7d7b49af03f807bd98e1c
  • alt-php56-dbx_5.6.40-139_amd64.deb
    sha:1a3c4bc567af7379619e23f24d7ba6c02211405b
  • alt-php56-dev_5.6.40-139_amd64.deb
    sha:35b9d0eec504e6a391e3d7f31a9ccf1d29b2206f
  • alt-php56-enchant_5.6.40-139_amd64.deb
    sha:4134d74bccc8a1064b8ca1fc083e045c7c854a9a
  • alt-php56-firebird_5.6.40-139_amd64.deb
    sha:5f4ef285e07845e5876a1d51c5634e0251168e70
  • alt-php56-gd_5.6.40-139_amd64.deb
    sha:b0624c85921547317cad733e8ebdb3e78e57b39e
  • alt-php56-imap_5.6.40-139_amd64.deb
    sha:b627c07426b30b32ca28038b0c624f3fb6c0f886
  • alt-php56-intl_5.6.40-139_amd64.deb
    sha:b9445406aa0dfb0bb9d4ba4dd79cce9268f81407
  • alt-php56-ldap_5.6.40-139_amd64.deb
    sha:8c415df7d8d7a0d130c55032ec6c1df508dfa0e6
  • alt-php56-mbstring_5.6.40-139_amd64.deb
    sha:936d4bc04a0f184d63016de223e96a2713096ddd
  • alt-php56-mcrypt_5.6.40-139_amd64.deb
    sha:3635935f16b983749ada90ef5bbe21007544306f
  • alt-php56-mysqlnd_5.6.40-139_amd64.deb
    sha:376193642570cc307eb94c7f8cee1bca369b86e6
  • alt-php56-odbc_5.6.40-139_amd64.deb
    sha:48cf392fa94b4a6266bf1731a42489e776eacee1
  • alt-php56-opcache_5.6.40-139_amd64.deb
    sha:4a76bf80d73f1965b961533ecea8fe4df85b5eb2
  • alt-php56-pdo_5.6.40-139_amd64.deb
    sha:bc5d521e88aa8b0a0a6f8e11528370593f4e1f64
  • alt-php56-pgsql_5.6.40-139_amd64.deb
    sha:11146813a663e6170786a2cd26dd5c58d92f6af0
  • alt-php56-php-fpm_5.6.40-139_amd64.deb
    sha:9cdbd3a0c484e283364ece8ef8ddc5a01b54c019
  • alt-php56-process_5.6.40-139_amd64.deb
    sha:f8f354a7550992ed9e151ae0b2c00390f688e8d2
  • alt-php56-pspell_5.6.40-139_amd64.deb
    sha:2939f4852ff73583bd774222b5b2dbf9963db312
  • alt-php56-recode_5.6.40-139_amd64.deb
    sha:8fce997c0501f69d1cf3b7672e31b1579148df82
  • alt-php56-snmp_5.6.40-139_amd64.deb
    sha:fcb60f544c45d84f302410f5f0ca906eee6c7388
  • alt-php56-soap_5.6.40-139_amd64.deb
    sha:5219111120ff48fcfdba95175e3b94135764c62c
  • alt-php56-sybase_5.6.40-139_amd64.deb
    sha:c4510ebe79024f14a943712382fcee52f7021063
  • alt-php56-tidy_5.6.40-139_amd64.deb
    sha:93bd2014a2d08e65c4bad9131dcf5e29a2c8b981
  • alt-php56-xml_5.6.40-139_amd64.deb
    sha:e27795934100d34eb0849b806aec780dd5545cf3
  • alt-php56-xmlrpc_5.6.40-139_amd64.deb
    sha:65b52f01d702deb54327502bce79eb9f844c2344
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.