[CLSA-2026:1790173144] Fix CVE(s): CVE-2014-3622
Type:
security
Severity:
Important
Release date:
2026-09-23 14:19:20 UTC
Description:
* ALTPHP-2571: restore the sticky-writable mode on /opt/alt/php56/var/lib/php/session from the Debian/Ubuntu postinst - dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root user could write session data * ALTEAPLN-3: no change to the Debian packaging - alt-php56-cli has never depended on the FPM package here. Recorded for parity with the RPM side, where a hard Requires was dropped so the FPM package can be removed on servers that only use PHP Selector via lsapi * ALTEAPLN-15: stop shipping the empty /opt/cpanel/alt-php56/root/etc/php-fpm.d/_.conf placeholder in the package. cPanel counts any *.conf in that directory as an enabled FPM pool and kept restarting alt-php56-fpm through chkservd on servers that never use FPM, even with the unit disabled. The alt-php56-php-fpm post-install script now creates the file with mode 0644 only when cPanel is absent - the only case where it is wanted, to silence php-fpm's include-glob warning - and deletes it when cPanel is present. Since no package owns the file any more, a new -php-fpm postrm removes it on remove and purge, so a stray *.conf cannot be left behind to re-trigger this bug if cPanel is installed later The default www pool is removed on cPanel hosts too, the same way as _.conf. cPanel writes its own per-domain pool under /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its API - verified serving a request with SAPI fpm-fcgi from that pool alone - so the shipped default pool was only letting the service run on hosts that never use FPM. It is still shipped and used off cPanel * ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since 7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master with SIGUSR2 and leave the service down * ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no rotate directive, so logrotate applied its default of 0 and deleted the previous log on every rotation, leaving no error-log history at all. Found while adding this config to php53-55, which had none
CVEs fixed:
Updated packages:
  • alt-php56_5.6.40-139_amd64.deb
    sha:ffe13e9141971045bcabadf959e4f78ba1f76aad
  • alt-php56-bcmath_5.6.40-139_amd64.deb
    sha:12bcb26c641c82226f2d8d6dfd6ae2669bc8c4cb
  • alt-php56-cli_5.6.40-139_amd64.deb
    sha:a42e0962e77c6abb2f9821b885004223ddcca13e
  • alt-php56-common_5.6.40-139_amd64.deb
    sha:e25065ea6088e51fae2eb566e2bdee28281bc83d
  • alt-php56-dba_5.6.40-139_amd64.deb
    sha:4c9193c74bc733550901a7756cf4ab53b0ad0c2c
  • alt-php56-dbx_5.6.40-139_amd64.deb
    sha:8a72e0b56646c8522cb0398e3863001213471310
  • alt-php56-dev_5.6.40-139_amd64.deb
    sha:edf9ef1ee6a66e5dca3781670583081efc6c1a02
  • alt-php56-enchant_5.6.40-139_amd64.deb
    sha:a470ae4922a751f055d4d85d802d371dd23d7845
  • alt-php56-firebird_5.6.40-139_amd64.deb
    sha:1dd07c1694d3a6f72c966d0660cd96c644840cd0
  • alt-php56-gd_5.6.40-139_amd64.deb
    sha:ede462559c3df4482e4516252fc9d4a23e67f8ea
  • alt-php56-imap_5.6.40-139_amd64.deb
    sha:242843e65c4c33f0eb6969be0ef0af7a6714516e
  • alt-php56-intl_5.6.40-139_amd64.deb
    sha:33e303f4a1d3c397a3cf846e9e4f915690ff5a0d
  • alt-php56-ldap_5.6.40-139_amd64.deb
    sha:3f79e3b9bf58c48442c08ed57306d04c8ee84073
  • alt-php56-mbstring_5.6.40-139_amd64.deb
    sha:753c406c6173f07072218f564e6fc9422dc7d612
  • alt-php56-mcrypt_5.6.40-139_amd64.deb
    sha:883baff51f8f3212749b6bbb092c255484c71a96
  • alt-php56-mysqlnd_5.6.40-139_amd64.deb
    sha:8663146848629c2138bdfc455674fa34fc7add4c
  • alt-php56-odbc_5.6.40-139_amd64.deb
    sha:a9121ff19bb20e6c9472500775b70c917eb706e2
  • alt-php56-opcache_5.6.40-139_amd64.deb
    sha:616bf618448907c5c4300a690a4e6ce0027f08fa
  • alt-php56-pdo_5.6.40-139_amd64.deb
    sha:1bb56baaef129d6aee3983b12edac603d971cd4d
  • alt-php56-pgsql_5.6.40-139_amd64.deb
    sha:25db41a3fda61b749ec8c19134c9561fa4c10573
  • alt-php56-php-fpm_5.6.40-139_amd64.deb
    sha:07a59d3aa8261ec490175b91257fa753733dd445
  • alt-php56-process_5.6.40-139_amd64.deb
    sha:b8fd8e41663e19134c0efb63f12840d3475c3588
  • alt-php56-pspell_5.6.40-139_amd64.deb
    sha:487f39832eb91af2ff05581aae4bee2ac0006510
  • alt-php56-recode_5.6.40-139_amd64.deb
    sha:2b5463ffcacd8b150b887e3318fa216be9068de0
  • alt-php56-snmp_5.6.40-139_amd64.deb
    sha:af9015e7d39cd16ea11c3a9549a22fe6d084ac97
  • alt-php56-soap_5.6.40-139_amd64.deb
    sha:5663fa30006ab890816c05832b6997901aadb40a
  • alt-php56-sybase_5.6.40-139_amd64.deb
    sha:91a984afaa130762a08e09899c4fe110ce3d23f1
  • alt-php56-tidy_5.6.40-139_amd64.deb
    sha:4fbf46b0a1aa9058881829e32e1bb6de3b3436a0
  • alt-php56-xml_5.6.40-139_amd64.deb
    sha:d44fe73f686c2175c5ba319f50850c2299fa69f5
  • alt-php56-xmlrpc_5.6.40-139_amd64.deb
    sha:ac497538e262c491a8d1b0c6c337dcc8ef2a97af
  • alt-php56_5.6.40-139_arm64.deb
    sha:55ccc8aa19c728af6d5e7fe011609402150eb8c2
  • alt-php56-bcmath_5.6.40-139_arm64.deb
    sha:8921e365023c7dd7a33f4399149fae47417461a4
  • alt-php56-cli_5.6.40-139_arm64.deb
    sha:416e22fa96b2f7c0873efec086243ee2fa60c7d2
  • alt-php56-common_5.6.40-139_arm64.deb
    sha:dc5ef23795d366705cc1c240100a46db5eba5b94
  • alt-php56-dba_5.6.40-139_arm64.deb
    sha:6177c1a42801755d992425fca5b2eb5566ef9063
  • alt-php56-dbx_5.6.40-139_arm64.deb
    sha:a4d48fe963e6bca86a33321cbdff6a6a330ad73a
  • alt-php56-dev_5.6.40-139_arm64.deb
    sha:1c18e9ae0564c1a964548980c730c58bd7fb5594
  • alt-php56-enchant_5.6.40-139_arm64.deb
    sha:79f858122236a65264e2698feb85a3c744be2f50
  • alt-php56-firebird_5.6.40-139_arm64.deb
    sha:e78a4981a03f6f51a8ddea1b28a578854274cc9d
  • alt-php56-gd_5.6.40-139_arm64.deb
    sha:18959eef14d88647e28e131169a30d405b26e009
  • alt-php56-imap_5.6.40-139_arm64.deb
    sha:a70e9a501922cd0cfa38dba734014acf505432fd
  • alt-php56-intl_5.6.40-139_arm64.deb
    sha:5c74e0d53e245154efd14b9ace007b03eca0c77c
  • alt-php56-ldap_5.6.40-139_arm64.deb
    sha:2495748b50eba3504a5933809a44ab98d54c5882
  • alt-php56-mbstring_5.6.40-139_arm64.deb
    sha:d1d5e3a0aa80597ecd5303d1f177b6ad7c511c4c
  • alt-php56-mcrypt_5.6.40-139_arm64.deb
    sha:6d0a8c054adca9889b2c2c165baafdfd4f0ffcd7
  • alt-php56-mysqlnd_5.6.40-139_arm64.deb
    sha:58d90081b04631fc2b2f6e59be2fca3dbc0a186c
  • alt-php56-odbc_5.6.40-139_arm64.deb
    sha:60d79ef1709de952a85c5eff1fbdb475beb47266
  • alt-php56-opcache_5.6.40-139_arm64.deb
    sha:33e0c43223358c0ccd08060ed2f1788709c4c6b3
  • alt-php56-pdo_5.6.40-139_arm64.deb
    sha:74ba146b87a1ea659e1146e79f1d0ddc5f3a13d6
  • alt-php56-pgsql_5.6.40-139_arm64.deb
    sha:5c0b9210e626cab047d7ef58d40eedc497c40123
  • alt-php56-php-fpm_5.6.40-139_arm64.deb
    sha:7659db06db9412d8d7f013f707ba798b32e4b00c
  • alt-php56-process_5.6.40-139_arm64.deb
    sha:cc2e398728418846519057fc96bb98e06492ff94
  • alt-php56-pspell_5.6.40-139_arm64.deb
    sha:67c78a626222870a78d3cb0d7217fa9f4314a71b
  • alt-php56-recode_5.6.40-139_arm64.deb
    sha:4f80e1a43d41b51795d317e36fc4e012193f0337
  • alt-php56-snmp_5.6.40-139_arm64.deb
    sha:78a0f2076f8eda341447dab4e5ea534bf8e11ef1
  • alt-php56-soap_5.6.40-139_arm64.deb
    sha:d3870ac9272cbc38c3eddba79394d1d51b325983
  • alt-php56-sybase_5.6.40-139_arm64.deb
    sha:9626c94e101e50fadbd7b505c6e1fcc93a423502
  • alt-php56-tidy_5.6.40-139_arm64.deb
    sha:1996bdef0c06c79e4246252ed74934ff21bc794d
  • alt-php56-xml_5.6.40-139_arm64.deb
    sha:3d8b4fbc7c479e15e6d054a23aca8ff83e713d4d
  • alt-php56-xmlrpc_5.6.40-139_arm64.deb
    sha:a8fa71e915878346d16b8a7cb61f9e39477e4c01
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.