Tuxcare Errata System 0.0.1 5.10 2026-07-24T16:47:32 Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3823 CVE-2023-3824 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3824 CVE-2023-3823 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3824 CVE-2023-3823 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3823 CVE-2023-3824 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3823 CVE-2023-3824 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3823 CVE-2023-3824 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3823 CVE-2023-3824 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3823 CVE-2023-3824 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3824 CVE-2023-3823 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix for hardened PHP - CVE-2023-3823: Fix external entity loading in XML without enabling by sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read() Critical TuxCare License Agreement CVE-2023-3824 CVE-2023-3823 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Remove unsafe search path logic, based on php-5.2.17 Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest - Remove generated zend_language files from tarball - Expand allowed version list for bison package Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest - Remove generated zend_language files from tarball - Constraint max version for bison package Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest Moderate TuxCare License Agreement CVE-2023-3247 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation Moderate TuxCare License Agreement CVE-2025-1861 CVE-2025-1217 CVE-2025-1734 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams Moderate TuxCare License Agreement CVE-2025-1217 CVE-2025-1734 CVE-2025-1861 CVE-2025-1219 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams Moderate TuxCare License Agreement CVE-2025-1861 CVE-2025-1217 CVE-2025-1734 CVE-2025-1219 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation Moderate TuxCare License Agreement CVE-2025-1217 CVE-2025-1219 CVE-2025-1734 CVE-2025-1861 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation Moderate TuxCare License Agreement CVE-2025-1734 CVE-2025-1217 CVE-2025-1861 CVE-2025-1219 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams - fix regression in CVE-2024-11234 patch Moderate TuxCare License Agreement CVE-2025-1734 CVE-2025-1219 CVE-2025-1217 CVE-2025-1861 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2019-9023: fix issues with encoding length Critical TuxCare License Agreement CVE-2025-1219 CVE-2019-9023 CVE-2025-1734 CVE-2025-1861 CVE-2025-1217 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation - CVE-2020-7071: avoid parse_url() returning a wrong host to user Moderate TuxCare License Agreement CVE-2025-1217 CVE-2025-1734 CVE-2025-1861 CVE-2020-7071 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation Moderate TuxCare License Agreement CVE-2025-1217 CVE-2025-1861 CVE-2025-1734 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation Moderate TuxCare License Agreement CVE-2025-1217 CVE-2025-1734 CVE-2025-1861 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1217: http stream wrapper: fix handling folded headers - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon - CVE-2025-1861: fix http redirect location truncation Moderate TuxCare License Agreement CVE-2025-1861 CVE-2025-1217 CVE-2025-1734 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-6491 CVE-2025-1220 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-1220 CVE-2025-6491 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-6491 CVE-2025-1220 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-1220 CVE-2025-6491 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2025-1220: fix null byte termination in hostnames - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large XML namespace prefix Moderate TuxCare License Agreement CVE-2025-1220 CVE-2025-6491 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Security fixes - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in regexec.c Important TuxCare License Agreement CVE-2019-19246 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Bump release to include CLOS-4506 and ALTPHP-2448 in RPM tag Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7261 CVE-2026-6722 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ALTPHP-2474: Rename www.conf.default to www.conf so FPM starts by default Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ALTPHP-2474: Rename www.conf.default to www.conf so FPM starts by default Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ALTPHP-2474: Rename www.conf.default to www.conf so FPM starts by default Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ALTPHP-2474: Rename www.conf.default to www.conf so FPM starts by default Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ALTPHP-2474: Rename www.conf.default to www.conf so FPM starts by default Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ELS-2362: build litespeed SAPI with devtoolset-7 on CL6 (lsapi uses C11 __atomic builtins requiring gcc >= 4.7) Critical TuxCare License Agreement CVE-2014-2270 CVE-2011-4885 CVE-2015-3330 CVE-2016-5766 CVE-2015-2787 CVE-2015-2783 CVE-2015-2348 CVE-2015-2301 CVE-2015-4598 CVE-2026-7262 CVE-2026-6735 CVE-2014-2497 CVE-2017-7890 CVE-2015-4024 CVE-2016-5399 CVE-2015-0231 CVE-2015-0232 CVE-2026-7261 CVE-2015-4021 CVE-2014-3587 CVE-2014-3710 CVE-2014-3668 CVE-2015-4022 CVE-2026-6722 CVE-2014-3597 CVE-2015-4025 CVE-2014-9652 CVE-2017-9229 CVE-2014-4698 CVE-2014-4670 CVE-2015-4026 CVE-2015-0273 CVE-2015-3411 CVE-2015-3329 CVE-2014-9709 CVE-2015-4147 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ELS-2362: build litespeed SAPI with devtoolset-7 on CL6 (lsapi uses C11 __atomic builtins requiring gcc >= 4.7) Critical TuxCare License Agreement CVE-2016-5766 CVE-2026-7262 CVE-2026-6735 CVE-2017-7890 CVE-2016-5399 CVE-2026-7261 CVE-2026-6722 CVE-2017-9229 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ELS-2362: build litespeed SAPI with devtoolset-7 on CL6 (lsapi uses C11 __atomic builtins requiring gcc >= 4.7) Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2017-7890 CVE-2026-7261 CVE-2026-6722 CVE-2017-9229 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2014-3515: SplObjectStorage::unserialize() type confusion in ext/spl/spl_observer.c — the unserialized members payload was passed to zend_hash_copy() without checking it is an array. Backport the spl_observer.c half of upstream a374dfab (reject non-IS_ARRAY members). Critical TuxCare License Agreement CVE-2013-6420 CVE-2016-5766 CVE-2013-4113 CVE-2026-7262 CVE-2015-4643 CVE-2012-2688 CVE-2015-4603 CVE-2014-3669 CVE-2016-5399 CVE-2014-9425 CVE-2014-9705 CVE-2012-0830 CVE-2026-7261 CVE-2015-4602 CVE-2026-6722 CVE-2014-3670 CVE-2016-4070 CVE-2016-10168 CVE-2015-4600 CVE-2017-9229 CVE-2015-4599 CVE-2015-4601 CVE-2015-4026 CVE-2014-3515 CVE-2012-1823 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2015-4604: fileinfo/libmagic out-of-bounds read in mcopy() FILE_SEARCH/FILE_REGEX (clamp offset to nbytes; backport of upstream file(1) f938112c) Important TuxCare License Agreement CVE-2015-4604 CVE-2016-4070 CVE-2016-10168 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2016-1283: heap buffer overflow in bundled PCRE 8.38 pcre_compile2() via a crafted regex with multiple identically named nested groups (ELSLANG-50866, ELSLANG-40077, ELSLANG-40080, ELSLANG-40110, ELSLANG-40125) - debian/patches/php-5.5-CVE-2016-1283.patch: backport PCRE 8.39 rev 1636 / PHP bug #75207 - remove the "else" so the named-group recno scan is always performed, over-allocating rather than under-allocating. PHP 5.5 was EOL before the bug #75207 backport landed for 5.6/7.0/7.1. Critical TuxCare License Agreement CVE-2016-1283 CVE-2016-10168 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ALTPHP-2474: Rename www.conf.default to www.conf so FPM starts by default Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7259 CVE-2025-14179 CVE-2026-7258 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ELS-2362: generate Plesk psa handler files only on rhel>=7 to match the %files guard (fixes "installed but unpackaged" psa files on EL6/CL6) Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7259 CVE-2025-14179 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ELS-2362: generate Plesk psa handler files only on rhel>=7 to match the %files guard (fixes "installed but unpackaged" psa files on EL6/CL6) Critical TuxCare License Agreement CVE-2026-7262 CVE-2026-6735 CVE-2026-7259 CVE-2025-14179 CVE-2026-7568 CVE-2026-7261 CVE-2026-6722 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. Adopt the same FPM layout as php70+: a global php-fpm.conf that includes php-fpm.d/*.conf plus a default www.conf pool listening on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple alt-php FPM services no longer collide on the same TCP port and per-domain pools in php-fpm.d still load. On Debian-like distros the pool group is set to nogroup (no nobody group). Drop the now redundant php-fpm.conf.default/.plesk. Important TuxCare License Agreement CVE-2016-5385 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Fix %changelog chronological order Important TuxCare License Agreement CVE-2016-5385 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2016-5385: do not honor untrusted client Proxy request header via HTTP_PROXY (httpoxy) Important TuxCare License Agreement CVE-2016-5385 CVE-2016-10167 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with padding (aes-*-wrap-pad, EVP_CIPH_WRAP_MODE). php_openssl_cipher_update() sized the output buffer as data_len + one cipher block, undersizing it for RFC 5649 padded wrap output (roundup(data_len, 8) + 8) and overflowing the zend_mm heap under OpenSSL 3.x. Reserve one extra block for wrap-mode ciphers. Backport of upstream php-src commit cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187). Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers; the output buffer was sized as data_len + one block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and corrupts the zend heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE. Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-pad (aes-*-wrap-pad) ciphers; the output buffer was sized as data_len + EVP_CIPHER_block_size, which under-sizes RFC 5649 padded-wrap output. Reserve an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream php-src cbc0489126a7682796aad1e5fb4e51de74af162c) Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + one cipher block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and overflows the heap when built against OpenSSL 3.x. Backport of upstream commit cbc0489126 (GH-22187): reserve one extra block for EVP_CIPH_WRAP_MODE ciphers. (5.6 has no php_openssl_cipher_update() helper; the fix is applied to the inline allocations in both openssl_encrypt() and openssl_decrypt()) Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with aes-*-wrap-pad by reserving an extra cipher block for RFC 5649 padded key-wrap output Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: fix openssl_encrypt() zend mm heap overflow on AES key-wrap-with-padding (aes-*-wrap-pad) by reserving an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream cbc0489126a7682796aad1e5fb4e51de74af162c) Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: openssl_encrypt() heap buffer overflow (zend_mm heap corruption) with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers when built against OpenSSL 3.x; size the output buffer for RFC 5649 padded wrap Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2012-0789: memory leak in the date/time extension - parsing a date string with an embedded timezone identifier (e.g. strtotime with "Europe/Paris") allocated a fresh timelib_tzinfo on every call that was never freed, letting a remote attacker exhaust memory; timezone lookups now go through the cached php_date_parse_tzfile_wrapper (upstream bug - CVE-2012-0831: magic_quotes_gpc could be re-enabled during request startup because it was reset with a direct PG() write instead of going through the INI subsystem while importing environment/server variables; now switched off via zend_alter_ini_entry_ex() (upstream bug #323016; the fpm SAPI hunk is dropped as 5.2 ships no fpm) - CVE-2014-4721: phpinfo() type confusion / information leak - the PHP_SELF, PHP_AUTH_TYPE, PHP_AUTH_USER and PHP_AUTH_PW request variables were printed with Z_STRVAL_PP() without a type check; each lookup now also requires Z_TYPE_PP(data) == IS_STRING (upstream bug #67498) Low TuxCare License Agreement CVE-2012-0831 CVE-2014-4721 CVE-2014-2497 CVE-2012-0789 CVE-2015-0232 CVE-2012-0057 CVE-2014-9709 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: heap buffer overflow in openssl_encrypt()/openssl_decrypt() with AES key-wrap-with-padding ciphers (aes-*-wrap-pad, RFC 5649) when built against OpenSSL 3.x (ELSLANG-59751, ELSLANG-59676, ELSLANG-59675, ELSLANG-59687, ELSLANG-59692) - debian/patches/php-5.5-CVE-2026-14355.patch: backport upstream cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187) - reserve one extra EVP_CIPHER_block_size for EVP_CIPH_WRAP_MODE ciphers at the output-buffer allocation. 5.5 has no php_openssl_cipher_update() helper, so the fix is applied to both inline call sites (openssl_encrypt + openssl_decrypt). Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with- padding ciphers (aes-*-wrap-pad); the output buffer was sized data_len + one block but RFC 5649 wrap-pad output can exceed that, so reserve an extra EVP_CIPHER_block_size() for EVP_CIPH_WRAP_MODE ciphers Important TuxCare License Agreement CVE-2014-3538 CVE-2026-14355 CVE-2013-7345 CVE-2014-1943 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: heap buffer overflow in openssl_encrypt() with AES key-wrap padding (aes-*-wrap-pad); reserve an extra EVP_CIPHER_block_size() block for EVP_CIPH_WRAP_MODE ciphers in php_openssl_cipher_update() Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with padding (aes-*-wrap-pad). php_openssl_cipher_update() sized the output buffer as data_len + one cipher block, undersizing it for RFC 5649 padded wrap output; reserve an extra block for EVP_CIPH_WRAP_MODE ciphers. Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA Community Enterprise Operating System 6 - Update to 8.2.32 Important TuxCare License Agreement CVE-2026-14355 cpe:/o:centos:linux:6:GA alt-php52 alt-php52-bcmath alt-php52-cli alt-php52-common alt-php52-dba alt-php52-dbx alt-php52-devel alt-php52-enchant alt-php52-firebird alt-php52-gd alt-php52-imap alt-php52-intl alt-php52-ldap alt-php52-mbstring alt-php52-mcrypt alt-php52-mssql alt-php52-ncurses alt-php52-odbc alt-php52-pdo alt-php52-pgsql alt-php52-process alt-php52-pspell alt-php52-recode alt-php52-snmp alt-php52-soap alt-php52-sqlite alt-php52-sybase alt-php52-tidy alt-php52-xml alt-php52-xmlrpc alt-php53 alt-php53-bcmath alt-php53-cli alt-php53-common alt-php53-dba alt-php53-dbx alt-php53-devel alt-php53-enchant alt-php53-firebird alt-php53-gd alt-php53-imap alt-php53-intl alt-php53-ldap alt-php53-mbstring alt-php53-mcrypt alt-php53-mssql alt-php53-mysqlnd alt-php53-odbc alt-php53-pdo alt-php53-pgsql alt-php53-process alt-php53-pspell alt-php53-recode alt-php53-snmp alt-php53-soap alt-php53-sqlite alt-php53-sybase alt-php53-tidy alt-php53-xml alt-php53-xmlrpc alt-php54 alt-php54-bcmath alt-php54-cli alt-php54-common alt-php54-dba alt-php54-dbx alt-php54-devel alt-php54-enchant alt-php54-firebird alt-php54-gd alt-php54-imap alt-php54-intl alt-php54-ldap alt-php54-mbstring alt-php54-mcrypt alt-php54-mssql alt-php54-mysqlnd alt-php54-odbc alt-php54-pdo alt-php54-pgsql alt-php54-process alt-php54-pspell alt-php54-recode alt-php54-snmp alt-php54-soap alt-php54-sybase alt-php54-tidy alt-php54-xml alt-php54-xmlrpc alt-php55 alt-php55-bcmath alt-php55-cli alt-php55-common alt-php55-dba alt-php55-dbx alt-php55-devel alt-php55-enchant alt-php55-firebird alt-php55-gd alt-php55-imap alt-php55-intl alt-php55-ldap alt-php55-mbstring alt-php55-mcrypt alt-php55-mssql alt-php55-mysqlnd alt-php55-odbc alt-php55-pdo alt-php55-pgsql alt-php55-process alt-php55-pspell alt-php55-recode alt-php55-snmp alt-php55-soap alt-php55-sybase alt-php55-tidy alt-php55-xml alt-php55-xmlrpc alt-php56 alt-php56-bcmath alt-php56-cli alt-php56-common alt-php56-dba alt-php56-dbx alt-php56-devel alt-php56-enchant alt-php56-firebird alt-php56-gd alt-php56-imap alt-php56-intl alt-php56-ldap alt-php56-mbstring alt-php56-mcrypt alt-php56-mssql alt-php56-mysqlnd alt-php56-odbc alt-php56-pdo alt-php56-pgsql alt-php56-process alt-php56-pspell alt-php56-recode alt-php56-snmp alt-php56-soap alt-php56-sybase alt-php56-tidy alt-php56-xml alt-php56-xmlrpc alt-php70 alt-php70-bcmath alt-php70-cli alt-php70-common alt-php70-dba alt-php70-devel alt-php70-enchant alt-php70-firebird alt-php70-gd alt-php70-imap alt-php70-intl alt-php70-ldap alt-php70-mbstring alt-php70-mcrypt alt-php70-mysqlnd alt-php70-odbc alt-php70-opcache alt-php70-pdo alt-php70-pgsql alt-php70-process alt-php70-pspell alt-php70-recode alt-php70-snmp alt-php70-soap alt-php70-tidy alt-php70-xml alt-php70-xmlrpc alt-php71 alt-php71-bcmath alt-php71-cli alt-php71-common alt-php71-dba alt-php71-devel alt-php71-enchant alt-php71-firebird alt-php71-gd alt-php71-imap alt-php71-intl alt-php71-ldap alt-php71-mbstring alt-php71-mcrypt alt-php71-mysqlnd alt-php71-odbc alt-php71-opcache alt-php71-pdo alt-php71-pgsql alt-php71-process alt-php71-pspell alt-php71-recode alt-php71-snmp alt-php71-soap alt-php71-tidy alt-php71-xml alt-php71-xmlrpc alt-php72 alt-php72-bcmath alt-php72-cli alt-php72-common alt-php72-dba alt-php72-devel alt-php72-enchant alt-php72-firebird alt-php72-gd alt-php72-imap alt-php72-intl alt-php72-ldap alt-php72-mbstring alt-php72-mysqlnd alt-php72-odbc alt-php72-opcache alt-php72-pdo alt-php72-pgsql alt-php72-process alt-php72-pspell alt-php72-recode alt-php72-snmp alt-php72-soap alt-php72-sodium alt-php72-tidy alt-php72-xml alt-php72-xmlrpc alt-php72-zts alt-php72-zts-devel alt-php73 alt-php73-bcmath alt-php73-cli alt-php73-common alt-php73-dba alt-php73-devel alt-php73-enchant alt-php73-firebird alt-php73-gd alt-php73-imap alt-php73-intl alt-php73-ldap alt-php73-mbstring alt-php73-mysqlnd alt-php73-odbc alt-php73-opcache alt-php73-pdo alt-php73-pgsql alt-php73-process alt-php73-pspell alt-php73-recode alt-php73-snmp alt-php73-soap alt-php73-sodium alt-php73-tidy alt-php73-xml alt-php73-xmlrpc alt-php74 alt-php74-bcmath alt-php74-cli alt-php74-common alt-php74-dba alt-php74-devel alt-php74-enchant alt-php74-firebird alt-php74-gd alt-php74-imap alt-php74-intl alt-php74-ldap alt-php74-mbstring alt-php74-mysqlnd alt-php74-odbc alt-php74-opcache alt-php74-pdo alt-php74-pgsql alt-php74-process alt-php74-pspell alt-php74-snmp alt-php74-soap alt-php74-sodium alt-php74-tidy alt-php74-xml alt-php74-xmlrpc alt-php51 alt-php51-bcmath alt-php51-cli alt-php51-common alt-php51-dba alt-php51-devel alt-php51-firebird alt-php51-gd alt-php51-imap alt-php51-ldap alt-php51-mbstring alt-php51-mcrypt alt-php51-ncurses alt-php51-odbc alt-php51-pdo alt-php51-pgsql alt-php51-process alt-php51-snmp alt-php51-soap alt-php51-sybase alt-php51-tidy alt-php51-xml alt-php51-xmlrpc alt-php56-fpm alt-php71-php-fpm alt-php72-fpm alt-php73-fpm alt-php74-fpm alt-php80 alt-php80-bcmath alt-php80-cli alt-php80-common alt-php80-dba alt-php80-devel alt-php80-enchant alt-php80-firebird alt-php80-fpm alt-php80-gd alt-php80-imap alt-php80-intl alt-php80-ldap alt-php80-mbstring alt-php80-mysqlnd alt-php80-odbc alt-php80-opcache alt-php80-pdo alt-php80-pgsql alt-php80-process alt-php80-pspell alt-php80-snmp alt-php80-soap alt-php80-sodium alt-php80-tidy alt-php80-xml alt-php70-fpm alt-php53-fpm alt-php54-fpm alt-php55-fpm alt-php53-php-fpm alt-php54-php-fpm alt-php56-php-fpm alt-php55-php-fpm alt-php56-opcache alt-php70-php-fpm alt-php72-php-fpm alt-php73-php-fpm alt-php74-php-fpm alt-php55-opcache alt-php82 alt-php82-bcmath alt-php82-cli alt-php82-common alt-php82-dba alt-php82-devel alt-php82-enchant alt-php82-firebird alt-php82-gd alt-php82-gmp alt-php82-imap alt-php82-intl alt-php82-ldap alt-php82-mbstring alt-php82-mysqlnd alt-php82-odbc alt-php82-opcache alt-php82-pdo alt-php82-pgsql alt-php82-php-fpm alt-php82-process alt-php82-pspell alt-php82-snmp alt-php82-soap alt-php82-sodium alt-php82-tidy alt-php82-xml alt-php80-php-fpm alt-php81 alt-php81-bcmath alt-php81-cli alt-php81-common alt-php81-dba alt-php81-devel alt-php81-enchant alt-php81-firebird alt-php81-gd alt-php81-gmp alt-php81-imap alt-php81-intl alt-php81-ldap alt-php81-mbstring alt-php81-mysqlnd alt-php81-odbc alt-php81-opcache alt-php81-pdo alt-php81-pgsql alt-php81-php-fpm alt-php81-process alt-php81-pspell alt-php81-snmp alt-php81-soap alt-php81-sodium alt-php81-tidy alt-php81-xml x86_64 0:5.2.17-194.el6 8c55a6628608cb71 x86_64 0:5.3.29-163.el6 x86_64 0:5.4.45-145.el6 x86_64 1:5.5.38-125.el6 x86_64 0:5.6.40-79.el6 x86_64 0:7.0.33-77.el6 x86_64 0:7.1.33-47.el6 x86_64 0:7.2.34-32.el6 x86_64 1:7.3.33-17.el6 x86_64 0:7.4.33-12.el6 x86_64 0:5.1.6-166.el6 x86_64 0:5.2.17-195.el6 x86_64 0:5.3.29-164.el6 x86_64 0:5.4.45-146.el6 x86_64 1:5.5.38-126.el6 x86_64 0:5.6.40-80.el6 x86_64 0:7.0.33-78.el6 x86_64 0:7.1.33-48.el6 x86_64 1:7.3.33-18.el6 x86_64 0:7.4.33-13.el6 x86_64 0:5.6.40-104.el6 d07bf2a08d50eb66 x86_64 0:7.1.33-70.el6 x86_64 0:7.2.34-54.el6 x86_64 1:7.3.33-40.el6 x86_64 0:7.4.33-37.el6 x86_64 0:8.0.30-23.el6 x86_64 0:7.0.33-104.el6 x86_64 0:5.2.17-212.el6 x86_64 0:5.3.29-185.el6 x86_64 0:5.4.45-168.el6 x86_64 1:5.5.38-148.el6 x86_64 0:5.2.17-214.el6 x86_64 0:5.3.29-187.el6 x86_64 0:5.4.45-170.el6 x86_64 0:5.6.40-106.el6 x86_64 1:5.5.38-150.el6 x86_64 0:5.6.40-109.el6 x86_64 0:7.0.33-109.el6 x86_64 0:7.1.33-76.el6 x86_64 0:5.2.17-215.el6 x86_64 0:5.3.29-188.el6 x86_64 0:5.4.45-171.el6 x86_64 1:5.5.38-151.el6 x86_64 0:5.6.40-129.el6 x86_64 0:7.0.33-130.el6 x86_64 0:7.1.33-96.el6 x86_64 0:7.2.34-80.el6 x86_64 1:7.3.33-64.el6 x86_64 0:7.4.33-59.el6 x86_64 0:5.3.29-199.el6 x86_64 0:5.4.45-181.el6 x86_64 1:5.5.38-162.el6 x86_64 0:5.2.17-226.el6 x86_64 0:5.3.29-201.el6 x86_64 1:5.5.38-164.el6 x86_64 0:8.2.31-6.el6 x86_64 0:8.0.30-52.el6 x86_64 0:8.1.34-21.el6 x86_64 0:5.3.29-204.el6 x86_64 0:5.2.17-229.el6 x86_64 0:5.4.45-184.el6 x86_64 0:8.1.34-24.el6 x86_64 0:7.2.34-84.el6 x86_64 0:7.0.33-135.el6 x86_64 0:5.6.40-133.el6 x86_64 0:5.4.45-186.el6 x86_64 0:7.1.33-100.el6 x86_64 1:7.3.33-68.el6 x86_64 0:5.2.17-231.el6 x86_64 1:5.5.38-167.el6 x86_64 0:5.3.29-206.el6 x86_64 0:8.0.30-55.el6 x86_64 0:7.4.33-64.el6 x86_64 0:8.2.32-1.el6