[CLSA-2026:1790162744] Fix CVE(s): CVE-2014-3622
Type:
security
Severity:
Important
Release date:
2026-09-23 11:26:03 UTC
Description:
* ALTPHP-2571: restore the sticky-writable mode on /opt/alt/php56/var/lib/php/session from the Debian/Ubuntu postinst - dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root user could write session data * ALTEAPLN-3: no change to the Debian packaging - alt-php56-cli has never depended on the FPM package here. Recorded for parity with the RPM side, where a hard Requires was dropped so the FPM package can be removed on servers that only use PHP Selector via lsapi * ALTEAPLN-15: stop shipping the empty /opt/cpanel/alt-php56/root/etc/php-fpm.d/_.conf placeholder in the package. cPanel counts any *.conf in that directory as an enabled FPM pool and kept restarting alt-php56-fpm through chkservd on servers that never use FPM, even with the unit disabled. The alt-php56-php-fpm post-install script now creates the file with mode 0644 only when cPanel is absent - the only case where it is wanted, to silence php-fpm's include-glob warning - and deletes it when cPanel is present. Since no package owns the file any more, a new -php-fpm postrm removes it on remove and purge, so a stray *.conf cannot be left behind to re-trigger this bug if cPanel is installed later The default www pool is removed on cPanel hosts too, the same way as _.conf. cPanel writes its own per-domain pool under /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its API - verified serving a request with SAPI fpm-fcgi from that pool alone - so the shipped default pool was only letting the service run on hosts that never use FPM. It is still shipped and used off cPanel * ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since 7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master with SIGUSR2 and leave the service down * ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no rotate directive, so logrotate applied its default of 0 and deleted the previous log on every rotation, leaving no error-log history at all. Found while adding this config to php53-55, which had none
CVEs fixed:
Updated packages:
  • alt-php56_5.6.40-139_amd64.deb
    sha:ffe13e9141971045bcabadf959e4f78ba1f76aad
  • alt-php56-bcmath_5.6.40-139_amd64.deb
    sha:ddb5d7393b4a800922a914e37b251a5e4cffc3ea
  • alt-php56-cli_5.6.40-139_amd64.deb
    sha:9c12308b560129f8abda6aa9276a9fee0efeb82e
  • alt-php56-common_5.6.40-139_amd64.deb
    sha:bcce2a97606159f9bd383fedf92c175c4f72e886
  • alt-php56-dba_5.6.40-139_amd64.deb
    sha:41b63e63c00659efeebe9dc9f1aee87726a77f0d
  • alt-php56-dbx_5.6.40-139_amd64.deb
    sha:6fc8735d6622ede88faa5c4158f9e16d42d6c8c5
  • alt-php56-dev_5.6.40-139_amd64.deb
    sha:711d3edec619251004998f9af96a74df48619f17
  • alt-php56-enchant_5.6.40-139_amd64.deb
    sha:f86233c04fbe52bc94e07ed940d557d782765d39
  • alt-php56-firebird_5.6.40-139_amd64.deb
    sha:7263313a1120d7ff1bacaac25f16a0063f4b580b
  • alt-php56-gd_5.6.40-139_amd64.deb
    sha:094846c4c49af9288ff9b3fc214a9a450b44ef22
  • alt-php56-imap_5.6.40-139_amd64.deb
    sha:2af29f736a7289f181f6734c28810ec55e1644ea
  • alt-php56-intl_5.6.40-139_amd64.deb
    sha:ce4c983eed202145f8ef1ebb1d4c22874f86f6ef
  • alt-php56-ldap_5.6.40-139_amd64.deb
    sha:39af59a8065e9d2c9684508abc54cb5b8f2e879d
  • alt-php56-mbstring_5.6.40-139_amd64.deb
    sha:fc78a3568bc5a4cd145d87314037d2a81872a9e8
  • alt-php56-mcrypt_5.6.40-139_amd64.deb
    sha:dcbbf000f125f8626b5b8c0e608a6697af53df1c
  • alt-php56-mysqlnd_5.6.40-139_amd64.deb
    sha:014d2b8aadb01d2c2bc450feeb9f37c48cc55f50
  • alt-php56-odbc_5.6.40-139_amd64.deb
    sha:99fdd06e6a365f9515203de2f65bfe16ae929669
  • alt-php56-opcache_5.6.40-139_amd64.deb
    sha:21693bd846b85b0aa678e2406e72c16dc741cabd
  • alt-php56-pdo_5.6.40-139_amd64.deb
    sha:dd08bf244b35d9b757d01d758a124d229a3993e1
  • alt-php56-pgsql_5.6.40-139_amd64.deb
    sha:24206a1762f42e8f9ed8fc94c5f65c157a7425fc
  • alt-php56-php-fpm_5.6.40-139_amd64.deb
    sha:0d851b7c0225b7cd612d57e64ed2b1a256cba1f8
  • alt-php56-process_5.6.40-139_amd64.deb
    sha:1fd5a215d56259379125e0274ba20fd89c49d023
  • alt-php56-pspell_5.6.40-139_amd64.deb
    sha:f88200983a987b8cd9c0d6c7c5d87bc68c7e0854
  • alt-php56-recode_5.6.40-139_amd64.deb
    sha:d5ed15b26e56b5141d35a42a0da2558cd6756f80
  • alt-php56-snmp_5.6.40-139_amd64.deb
    sha:bd8c31954e6421b11fb9bd22fc13a1c5a7cf2885
  • alt-php56-soap_5.6.40-139_amd64.deb
    sha:24fcc0929a6545e06ae7c3dce09c71f52208a7cc
  • alt-php56-sybase_5.6.40-139_amd64.deb
    sha:6cba380a6d6df08f191aaa5736d477641a6c0864
  • alt-php56-tidy_5.6.40-139_amd64.deb
    sha:3342b279c9fb12151bb4808a0f10d1412ab91a16
  • alt-php56-xml_5.6.40-139_amd64.deb
    sha:787b05d32dc9e58f169a9b27ad65cade04050288
  • alt-php56-xmlrpc_5.6.40-139_amd64.deb
    sha:0493e75d779afaffb2a5094ab28ea01a9f1e6aa0
  • alt-php56_5.6.40-139_arm64.deb
    sha:55ccc8aa19c728af6d5e7fe011609402150eb8c2
  • alt-php56-bcmath_5.6.40-139_arm64.deb
    sha:57a54d8d5a8d8ffa3d2568a343c098ccb68e1da1
  • alt-php56-cli_5.6.40-139_arm64.deb
    sha:e40587190c4fb68980b5b9cc7101ecace6b4c579
  • alt-php56-common_5.6.40-139_arm64.deb
    sha:ed1cf8a8cfa2154609a1095b51a85e2a997dd1a8
  • alt-php56-dba_5.6.40-139_arm64.deb
    sha:e43d776c1b0b46c666da17db277741fed869039a
  • alt-php56-dbx_5.6.40-139_arm64.deb
    sha:2491018e19ab5047894062f3fb2a22c302e1dd8c
  • alt-php56-dev_5.6.40-139_arm64.deb
    sha:570c95677cfb0e5d073e30aee2d3632c9d85781c
  • alt-php56-enchant_5.6.40-139_arm64.deb
    sha:8ef9ad5d8b4a17734f761ba180ea30f9605977e3
  • alt-php56-firebird_5.6.40-139_arm64.deb
    sha:3d5e595f8af5e47f4f3d0eddba8887db2914c603
  • alt-php56-gd_5.6.40-139_arm64.deb
    sha:e68b2ed3b521920ff80c9f53b0e8b48dc66588be
  • alt-php56-imap_5.6.40-139_arm64.deb
    sha:a924cd469c028b3d2ff074cb6a066082f4a89ff9
  • alt-php56-intl_5.6.40-139_arm64.deb
    sha:1c51c792732e8886155732a3997ea345bd6aad91
  • alt-php56-ldap_5.6.40-139_arm64.deb
    sha:f382effd99ed73091e6e9bb6bae0e3e0ba4859a9
  • alt-php56-mbstring_5.6.40-139_arm64.deb
    sha:35dd9dad2a55f262a6b75aa1ebbd466e0d911f7d
  • alt-php56-mcrypt_5.6.40-139_arm64.deb
    sha:5483124901554526e931ef406aa069b4f3ef6230
  • alt-php56-mysqlnd_5.6.40-139_arm64.deb
    sha:b7d9e94f1b6005bd8e555cd5112be78715d55a6a
  • alt-php56-odbc_5.6.40-139_arm64.deb
    sha:7155dcc3f22733290d03ab714d3cf8fe6e134f8b
  • alt-php56-opcache_5.6.40-139_arm64.deb
    sha:dafc716e1bb3cd0187aef88d124e4e65871ac460
  • alt-php56-pdo_5.6.40-139_arm64.deb
    sha:8199f5f95b80217497822a2dc0e6ce03c3951c9f
  • alt-php56-pgsql_5.6.40-139_arm64.deb
    sha:4be82b0f0ef60d5e43dfe20737e4894a8f6b3b1c
  • alt-php56-php-fpm_5.6.40-139_arm64.deb
    sha:7f0a3b6aff6ec8a2cae6b9c3339c1789a68cbe9d
  • alt-php56-process_5.6.40-139_arm64.deb
    sha:84b7c25fe068df71bc1814fd97b78499e2b0ef84
  • alt-php56-pspell_5.6.40-139_arm64.deb
    sha:0520069a359ddecee0463474ebc2710a4af5630a
  • alt-php56-recode_5.6.40-139_arm64.deb
    sha:22e92afa6718003563483097710aec902f6f1788
  • alt-php56-snmp_5.6.40-139_arm64.deb
    sha:4f85425ed27d011a67a721361a19edab2494bb19
  • alt-php56-soap_5.6.40-139_arm64.deb
    sha:8671ded38da7770fb77320a75b195057498583b0
  • alt-php56-sybase_5.6.40-139_arm64.deb
    sha:9bdd1b6cd0417e4ebe64091eba964b97bd935a89
  • alt-php56-tidy_5.6.40-139_arm64.deb
    sha:ec7da4dab05bfb4f224c3c33cd086f60a3df715d
  • alt-php56-xml_5.6.40-139_arm64.deb
    sha:bd78707d0244a276cc488057ef6fbe446a989f62
  • alt-php56-xmlrpc_5.6.40-139_arm64.deb
    sha:e6273854a49ebc23678385f199551054051123ec
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.