# changelog

author: Igor Savenko <bliss@cloudlinux.com> 4.0.50-5
changelog:
  - Fixed spec file (added /opt/passenger to %files section)
  - Added pre-creating dir for apache conf files in handle_module.py


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.26-21
changelog:
  - Rebase upon passenger-5.0.26
  - Added support for DirectAdmin
  - More robust alt-mod-passenger installation routine for CPanel servers
  - Deploy pre-built binaries for non CPanel servers
    (thus no custom httpd-devel, alt-mod-passenger depends on)
  - Use pre-built ruby native support library for all CloudLinux alt-ruby versions,
    so that the library is not built on-fly per user app first invokation


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.29-22
changelog:
  - Rebase upon passenger-5.0.29
  - Return back to Passenger 4.0 tmp/restart.txt behavour (minimal lag
    between touching app/tmp/restart.txt and app restart)
  - Fixup installation script for non-panel server


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-26
changelog:
  - Support httpd, httpd24 and EA4 apache with same passenger
  - New passenger version 5.0.29
  - Small bug fixes


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-27
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs


author: Vladimir Prokofev <vprokofev@cloudlinux.com> - 5.0.29-27.2
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs
  - Provides ea-apache24-alt_mod_passenger package name


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-3
changelog:
  - Check configs to migrate from 4.x to 5.x Passenger
  - Restart Passenger (via httpd) to reload fresh liblve


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-4
changelog:
  - Install Passenger into separate version folders
  - Tune simlinks to point to proper Passenger version
  - Fix permissions of PassengerInstanceRegistryDir to 755


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.6-1
changelog:
  - ALMODP-77: Make /var/passenger less worldwide accessible
  - ALMODP-60: Use `PASSENGER_INSTANCE_REGISTRY_DIR` instead `PASSENGER_TEMP_DIR`
  - ALMODP-81: Add conflict for package ea-ruby24-mod_passenger


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.11-1
changelog:
  - ALMODP-91: Arbitrary file read vulnerability in passenger
  - ALMODP-89: Made graceful reload Apache instead of restart when alt-mod-passenger install/update
  - Remove dependency from old package which obsoletes ea-apache24-alt_mod_passenger
  - ALMODP-86: Add Node.js language support for alt-mod-passenger


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-2
changelog:
  - ALMODP-112: disable nodejs handler by default
  - ALMODP-111: allow PassengerFriendlyErrorPages PassengerAppEnv passenger directives in htaccess


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Ability to provide which handlers to treat as suexec, and which to treat regularly <commit: 37ad6a8d6dafd9486217f60e369c530c17510ac6>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Fixed issue when mod_hostinglimits intercepts request already in lve (when php is done via cgi) <commit: abccd6a8276eefca2e50dcf03cfb0519fe3b6f26>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - add mode -m 644 to spec file and add php-script to modhostinglimits.conf <commit: 6bf688d72a68442b2886926fba8cb19ba6a10fc7>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Added directories/confgis to make sure mod_hostinglimits compiles under directadmin <commit: 242e320b83b167435f2b2dccb7c4d3ca045e3a42>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - fix spec file's string with liblve to lve-devel. liblve - for future releases <commit: fb10d65ba6364b6ce78e70e3decbf8200b8a0be2>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - moved p_cookie to be taken from request_config, making module MPM Worker safe <commit: fdab876e8fb52f0f3a21f9fa836cc411b9d4a392>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Merge branch 'master' of gitosis@pylesos.interdon.net:mod_hostinglimits <commit: f3b7c8df2280fa81b54c33dc53bf6d46f7cf4caa>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug when p_cookie is not installed process was fall down <commit: 44668ecf8599ee39ab8f21ae632d0e4514f67192>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Add private thread variable p-cookie instead mutex <commit: a3d7f50a59f2f94b463edfdf76f67c4a5235cfd8>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug with User and Group params. I can get it bu using server record <commit: 54be580ac5db55913a32a5cf8fb01981a671ef84>


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-1
changelog:
  - [#Feature 189] AllowedHandlers and DenyHandlers directives regex support is added
    - [#Feature 191] DenyHandlers directive support is added
    - Allow to serve content on LVE re-entry(apache 1.3)


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-1
changelog:
  - Add new spec file 3 rpm in 1 spec file
    - Add fix in *.cmake file for building under H-Sphere 3.1


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-2
changelog:
  - Added support for new LVEErrorCode directive
    - Default LVEErrorCode is changed from 503 to 508, default error 508 page is added in module source
    - Bug fix: checking whether we are already in LVE (errno should be EPERM, not -EALREADY)
    - Bug fix: logging "already in LVE" error in module for Apache 1.3


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-8
changelog:
  - Restored leave hendler                                                                                                                                    
  - Removed request pool data storing                                                                                                                         
  - Disable empty host debugging
  - Added new directive LVESitesDebug                                                                                                                         
  - Re-entry procedure restored                                                                                                                               
  - Optimized leave handler                                                                                                                                   
  - Optimized work with child pools
  - Reset errno on module initializtion
  - Repaired lve available check
  - Added support mod_ruid2                                                                                                                                   
  - Added new derctive LVEUser                                                                                                   
  - Added support of apache-mpm-itk


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-15
changelog:
  - Added support new apr                                                                                                                                     
  - Removed h-sphere support. No more need


author: Alexey Berezhok <alexey_com@ukr.net> 0.8-1
changelog:
  - Added LVERetryAfter: send RetryAfter header
  - Added LVEParseMode: there are three modes of working(CONF, PATH, OWNER)
  - Added LVEPathRegexp: regexp expression for username extracting from path(PATH mode)
  - Added LVEHeaderName: not supported yet
  - Added URL with error description in log


author: Alexey Berezhok <alexey_com@ukr.net> 1.0-5
changelog:
  - Added LVEUids debug
  - Fixed bug with mod_userdir + mod_hostinglimits
  - Renew lve api for apache 1.3


author: Stefan Mortensen <stefan.mortensen@atomia.com>, Mikhail Zhbankov <mzhbankov@cloudlinux.com> 1.0-26
changelog:
  - Fixed issue where cfg->path_regex was never being set when setting a custom path with LVEPathRegexp causing the default to always be used
  - AAP-57: mod_hostinglimits not increases EP in cgi mode (but process is in LVE)


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Rex Dieter <rdieter@fedoraproject.org> - 0.99.0-20.20091203
changelog:
  - 20091203 snapshot
  - spec housecleaning
  - Tidy erroniously removes whitespace, causing mangled text (#481350)


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-2
changelog:
  - add HaredenedPHP patches:
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-4
changelog:
  - add HaredenedPHP patches:
  -   Added check that soap.wsdl_cache_dir conforms to open_basedir (CVE-2013-1635)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   Improve check for :memory: pseudo-filename in SQlite (CVE-2012-3365)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - EA-5807: enable php-tidy on rhel 6 and above
  - EA-5946: force requirement of ea-libtidy instead of .so from BuildRequires ea-libtidy-devel


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-5
changelog:
  - EA-2422: use ea-libcurl instead of system curl package
  - Disabled automatic Requires generation for curl subpackage


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-10.cloudlinux
changelog:
  - add require for ea-libnghttp2
  - EA-6484: Clarify Summary and Description for DSO
  - EA-6232: Build -curl with HTTP/2 support
  - Added ea-php51 symlinks to /usr/bin and /usr/local/bin


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-11.cloudlinux
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug70436: Use After Free Vulnerability in unserialize()
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.1.6-19.cloudlinux
changelog:
  - ZC-3551: Added versioning to ea-openssl and libcurl requirements.
  - ZC-3475: Update for ea-openssl shared object


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-23.cloudlinux.3
changelog:
  - Fix bug #77242: heap out of bounds read in xmlrpc_decode()
  - Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node
  - Fix bug #77380: Global out of bounds read in xmlrpc base64 code


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.2
changelog:
  - Fix bug #77390 (feof might hang on TLS streams in case of fragmented TLS records)
  - Fix #77431 SplFileInfo::__construct() accepts NUL bytes
  - Fixed bug #77494 (Disabling class causes segfault on member access)
  - Fix bug #77540 - Invalid Read on exif_process_SOFn
  - Fix #77546 iptcembed broken function
  - Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE
  - Fix bug #77630 - safer rename() procedure
  - LSAPI sem_timedwait synchronization fixed


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.4
changelog:
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77742
  - Fixed bug #77765
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.5
changelog:
  - Fix #77973: Uninitialized read in gdImageCreateFromXbm
  - Fix bug #77988 - heap-buffer-overflow on php_jpg_get16


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.8
changelog:
  - Fix bug #77124
  - Fix bug #78192 PDO SQLite SegFault when reuse statement after schema has changed
  - Fix #78212: Segfault in built-in webserver
  - Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
  - Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.13
changelog:
  - Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer)
  - Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
  - Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
  - Updated Litespeed SAPI to 7.6


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.16
changelog:
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.18
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79465: Read in urldecode() (CVE-2020-7067)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.19
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned. (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned. (CVE-2019-11048)
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 5.1.6-24.cloudlinux.20
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached
  - Update litespeed to 7.7 version


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.21
changelog:
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.23
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.1.6-24.cloudlinux.26
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - Fix build with ea-brotli-1.0.9


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-2
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: Fixed bug 71465: PHAR doesn't know about litespeed


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-6
changelog:
  - add HaredenedPHP patches:
  -   bug 73764: Crash while loading hostile phar archive (CVE-2016-10159)
  -   bug 73768: Memory corruption when loading hostile phar (CVE-2016-10160)
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 68447: grapheme_extract take an extra trailing character
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73773: Seg fault when loading hostile phar
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-8
changelog:
  - add HaredenedPHP patches:
  -   Improve check for :memory: pseudo-filename in SQlite (CVE-2012-3365)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   Added check that soap.wsdl_cache_dir conforms to open_basedir (CVE-2013-1635)
  -   bug 70350: ZipArchive::extractTo allows for directory traversal when creating directories (CVE-2014-9767)
  -   Disabled external entities loading (CVE-2013-1643, CVE-2013-1824)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - EA-5807: enable php-tidy on rhel 6 and above
  - EA-5946: force requirement of ea-libtidy instead of .so from BuildRequires ea-libtidy-devel


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.2.17-14.cloudlinux
changelog:
  - add require for ea-libnghttp2
  - EA-6484: Clarify Summary and Description for DSO
  - EA-6232: Build -curl with HTTP/2 support
  - Added ea-php52 symlinks to /usr/bin and /usr/local/bin


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.2.17-19.cloudlinux
changelog:
  - bug 75571: Potential infinite loop in gdImageCreateFromGifCtx
  - bug 74782: Reflected XSS in .phar 404 page


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.2.17-22.cloudlinux
changelog:
  - ZC-3552: Added versioning to ea-openssl and libcurl requirements.
  - ZC-3475: Update for ea-openssl shared object


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-26.cloudlinux.3
changelog:
  - Fix bug #77242: heap out of bounds read in xmlrpc_decode()
  - Fix bug #77247: heap buffer overflow in phar_detect_phar_fname_ext
  - Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node
  - Fix bug #77380: Global out of bounds read in xmlrpc base64 code


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.5
changelog:
  - Fix bug #77390 (feof might hang on TLS streams in case of fragmented TLS records)
  - Fix bug #77396 - Null Pointer Dereference in phar_create_or_parse_filename
  - Fix #77431 SplFileInfo::__construct() accepts NUL bytes
  - Fixed bug #77494 (Disabling class causes segfault on member access)
  - Fix bug #77540 - Invalid Read on exif_process_SOFn
  - Fix #77546 iptcembed broken function
  - Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE
  - Fix bug #77586 - phar_tar_writeheaders_int() buffer overflow
  - Fix bug #77630 - safer rename() procedure
  - LSAPI sem_timedwait synchronization fixed


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.10
changelog:
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77742
  - Fixed bug #77765
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.16
changelog:
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.20
changelog:
  - Fix #76342: file_get_contents waits twice specified timeout
  - Fix #76859 stream_get_line skips data if used with data-generating filter


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.23
changelog:
  - Fix bug #79099: OOB read in php_strip_tags_ex (CVE-2020-7059)
  - Fix bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.26
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.27
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.29
changelog:
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-3
changelog:
  - add HardenedPHP patches:
  -   CVE-2016-7412: Heap overflow in mysqlnd related to BIT fields
  -   CVE-2016-7413: wddx_deserialize use-after-free
  -   CVE-2016-7414: Out of bound when verify signature of zip phar in phar_parse_zipfile
  -   CVE-2016-7416: SEH buffer overflow msgfmt_format_message
  -   CVE-2016-7417: Missing type check when unserializing SplArray
  -   CVE-2016-7418: Out-Of-Bounds Read in php_wddx_push_element of wddx.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-4
changelog:
  - add HardenedPHP patches
  -   security bug 73189: Memcpy negative size parameter php_resolve_path
  -   security bug 73150: missing NULL check in dom_document_save_html
  -   security bug 73284: heap overflow in php_ereg_replace function
  -   security bug 73218: stack-buffer-overflow through "ResourceBundle" methods
  -   security bug 73208: integer overflow in imap_8bit caused heap corruption
  -   security bug 73082: string length overflow in mb_encode_* function
  -   security bug 73174: heap overflow in php_pcre_replace_impl
  -   security bug 73276: crash in openssl_random_pseudo_bytes function
  -   security bug 73275: crash in openssl_encrypt function
  -   security bug 73017: memory corruption in wordwrap function
  -   security bug 73240: Write out of bounds at number_format
  -   security bug 73073: CachingIterator null dereference when convert to string
  -   security bug 73293: NULL pointer dereference in SimpleXMLElement::asXML()
  - Force users on jailshell and noshell to be chrooted when using php-fpm
  - remove Type=notify from ea-php53-php-frm.service file


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-5
changelog:
  - ALTPHP-238: litespeed-php updated to 6.10
  - AL-1865: Back to ea-php "Ensure that php.d is not scanned when PHPRC is set" patch with mod_lsapi mode support


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-6
changelog:
  - add HardenedPHP patches:
  -   security bug 73356: crash in bzcompress function
  -   CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf
  -   security bug 72482: Illegal write/read access caused by gdImageAALine overflow
  -   security bug 72696: imagefilltoborder stackoverflow on truecolor images
  -   security bug 73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
  -   security bug 73144: Use-after-free in ArrayObject Deserialization
  -   security bug 73192: parse_url return wrong hostname
  -   security bug 73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-7
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: Fixed bug 71465: PHAR doesn't know about litespeed
  - Fixed bug 67587: Redirection loop on nginx with FPM


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-10
changelog:
  - add HaredenedPHP patches:
  -   bug 70014: openssl_random_pseudo_bytes() is not cryptographically secure (CVE-2015-8867)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   bug 70121: unserialize() could lead to unexpected methods execution / NULL pointer deref (CVE-2015-8876)
  -   bug 70350: ZipArchive::extractTo allows for directory traversal when creating directories (CVE-2014-9767)
  -   bug 71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut (CVE-2016-4073)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess
  - EA-5807: enable php-tidy on rhel 6 and above


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-14.cloudlinux
changelog:
  - add require for ea-libnghttp2
  - EA-6484: Clarify Summary and Description for DSO
  - EA-6232: Build -curl with HTTP/2 support
  - Added ea-php53 symlinks to /usr/bin and /usr/local/bin
  - EA-3685: do not create apache user/group since we use nobody


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-16.cloudlinux
changelog:
  - ALTPHP-364: Added сorrect exit from lve if the nproc limit is reached
  - EA-6574: Make permissions on FPM socket dir more secure


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-18.cloudlinux
changelog:
  - HB-2873: Added network-online.target to "After" in the service file
  - EA-6819: Patch to support libtidy 5.4.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.3.29-19.cloudlinux
changelog:
  - bug 75055 Out-Of-Bounds Read in timelib_meridian()
  - bug 72535 arcfour encryption stream filter crashes php


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.3.29-23.cloudlinux
changelog:
  - HB-3287: Increase open file limit for php-fpm by default
  - Filter libxml2.so from requires
  - HB-3263: Ensure securetmp is done before starting FPM
  - EA-7044: Adjust PHPs to use ea-libxml2
  - HB-3061: Fix epoll bug.


author: Ivan Danilov <idanilov@cloudlinux.com> 5.3.29-23.cloudlinux.3
changelog:
  - ALTPHP-482: Fix for bug 75605 Dumpable FPM child processes allow bypassing opcache access controls


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.2
changelog:
  - Fix bug #51068 (glob:// do not support current path relative)
  - Fix bug #77390 (feof might hang on TLS streams in case of fragmented TLS records)
  - Fix bug #77396 - Null Pointer Dereference in phar_create_or_parse_filename
  - Fix #77431 SplFileInfo::__construct() accepts NUL bytes
  - Fixed bug #77494 (Disabling class causes segfault on member access)
  - Fix bug #77540 - Invalid Read on exif_process_SOFn
  - Fix #77546 iptcembed broken function
  - Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE
  - Fix bug #77586 - phar_tar_writeheaders_int() buffer overflow
  - Fix bug #77630 - safer rename() procedure
  - LSAPI sem_timedwait synchronization fixed


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.4
changelog:
  - Fixed bug #50020 (DateInterval:createDateFromString() silently fails)
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77664 (Segmentation fault when using undefined constant in custom wrapper)
  - Fix bug #77677: WCOREDUMP not available on all systems
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77742
  - Fixed bug #77765
  - Fix #77921: static.php.net doesn't work anymore
  - Fix bug #77934 (php-fpm kill -USR2 not working)
  - Fix #77943: imageantialias($image, false); does not work
  - Fix #77944: Wrong meta pdo_type for bigint on LLP64
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.5
changelog:
  - Fix bug #77967 - Bypassing open_basedir restrictions via file uris
  - Fix #77973: Uninitialized read in gdImageCreateFromXbm
  - Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
  - Fix bug #78069 - Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow
  - AAP-272: fix error with uid comparison


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.9
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.14
changelog:
  - Fix #76342: file_get_contents waits twice specified timeout
  - Fix #76859 stream_get_line skips data if used with data-generating filter
  - Fix #78579: mb_decode_numericentity: args number inconsistency
  - Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.15
changelog:
  - Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer)
  - Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
  - Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
  - Fixed bug #78863 (DirectoryIterator class silently truncates after a nullbyte). (CVE-2019-11045)
  - Updated Litespeed SAPI to 7.6


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.18
changelog:
  - Fix bug #79078: Hypothetical use-after-free in curl_multi_add_handle
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.3.29-29.cloudlinux.21
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79514: Memory leaks while including unexistent file
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.3.29-29.cloudlinux.23
changelog:
  - Fix bug #62890: default_socket_timeout=-1 causes connection to timeout
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.3.29-29.cloudlinux.25
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)
  - Fix bug #80007: Potential type confusion in unixtojd() parameter parsing


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.3.29-29.cloudlinux.28
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - AAP-178: Added disable killing of PHP-FPM parent process in LVE when not enough of memory
  - Fix build with ea-brotli-1.0.9


author: Tom Callaway <tcallawa@redhat.com>
changelog:
  - bump to 5.0.0
  - add patch to prevent clobbering struct re_registers from regex.h
  - remove domxml references, replaced with dom now built-in
  - fix php.ini to refer to php5 not php4


author: Joe Orton <jorton@redhat.com> 5.0.1-1
changelog:
  - update to 5.0.1
  - only build shared modules once
  - put dom extension in php-dom subpackage again
  - move extension modules into %{_libdir}/php/modules
  - don't use --with-regex=system, it's ignored for the apache* SAPIs


author: Joe Orton <jorton@redhat.com> 5.0.2-4
changelog:
  - update to 5.0.2 (#127980)
  - build against mysqlclient10-devel
  - use new RTLD_DEEPBIND to load extension modules
  - drop explicit requirement for elfutils-devel
  - use AddHandler in default conf.d/php.conf (#135664)
  - "fix" round() fudging for recent gcc on x86
  - disable sqlite pending audit of warnings and subpackage split


author: Joe Orton <jorton@redhat.com> 5.0.2-5
changelog:
  - fix phpize installation for lib64 platforms
  - add fix for segfault in variable parsing introduced in 5.0.2


author: Joe Orton <jorton@redhat.com> 5.0.2-7
changelog:
  - truncate changelog at 4.3.1-1
  - merge from 4.3.x package:
   - enable mime_magic extension and Require: file (#130276)


author: Joe Orton <jorton@redhat.com> 5.0.3-1
changelog:
  - update to 5.0.3 (thanks to Robert Scheck et al, #143101)
  - enable xsl extension (#142174)
  - package both the xsl and dom extensions in php-xml
  - enable soap extension, shared (php-soap package) (#142901)
  - add patches from upstream 5.0 branch:
   * Zend_strtod.c compile fixes
   * correct php_sprintf return value usage


author: Joe Orton <jorton@redhat.com> 5.0.3-2
changelog:
  - install the ext/gd headers (#145891)
  - enable pcntl extension in /usr/bin/php (#142903)
  - add libmbfl array arithmetic fix (dcb314@hotmail.com, #143795)
  - add BuildRequire for recent pcre-devel (#147448)


author: Joe Orton <jorton@redhat.com> 5.0.3-4
changelog:
  - package mysqli extension in php-mysql
  - really enable pcntl (#142903)
  - don't build with --enable-safe-mode (#148969)
  - use "Instant Client" libraries for oci8 module (Kai Bolay, #149873)


author: Joe Orton <jorton@redhat.com> 5.0.3-5
changelog:
  - BuildRequire mysql-devel >= 4.1
  - don't mark php.ini as noreplace to make upgrades work (#152171)
  - fix subpackage descriptions (#152628)
  - fix memset(,,0) in Zend (thanks to Dave Jones)
  - fix various compiler warnings in Zend


author: Joe Orton <jorton@redhat.com> 5.0.4-1
changelog:
  - update to 5.0.4 (#153068)
  - add .phps AddType to php.conf (#152973)
  - better gcc4 fix for libxmlrpc


author: Joe Orton <jorton@redhat.com> 5.0.4-4
changelog:
  - bundle from PEAR: HTTP, Mail, XML_Parser, Net_Socket, Net_SMTP
  - snmp: disable MSHUTDOWN function to prevent error_log noise (#153988)
  - mysqli: add fix for crash on x86_64 (Georg Richter, upstream #32282)


author: Joe Orton <jorton@redhat.com> 5.0.4-6
changelog:
  - build /usr/bin/php with the CLI SAPI, and add /usr/bin/php-cgi,
    built with the CGI SAPI (thanks to Edward Rudd, #137704)
  - add php(1) man page for CLI
  - fix more test cases to use -n when invoking php


author: Joe Orton <jorton@redhat.com> 5.0.4-7
changelog:
  - split out dba and bcmath extensions into subpackages
  - BuildRequire gcc-c++ to avoid AC_PROG_CXX{,CPP} failure (#155221)
  - pear: update to DB-1.7.6
  - enable FastCGI support in /usr/bin/php-cgi (#149596)


author: Joe Orton <jorton@redhat.com> 5.0.4-9
changelog:
  - build simplexml_import_dom even with shared dom (#156434)
  - prevent truncation of copied files to ~2Mb (#155916)
  - install /usr/bin/php from CLI build alongside CGI
  - enable sysvmsg extension (#142988)


author: Joe Orton <jorton@redhat.com> 5.0.5-3
changelog:
  - update to 5.0.5
  - add fix for upstream #34435
  - devel: require autoconf, automake (#159283)
  - pear: update to HTTP-1.3.6, Mail-1.1.8, Net_SMTP-1.2.7, XML_RPC-1.4.1
  - fix imagettftext et al (upstream, #161001)


author: Joe Orton <jorton@redhat.com> 5.1.1-2
changelog:
  - update to 5.1.1
  - remove pear subpackage
  - enable pdo extensions (php-pdo subpackage)
  - remove non-standard conditional module builds
  - enable xmlreader extension


author: Joe Orton <jorton@redhat.com> 5.1.2-5
changelog:
  - provide php-api (#183227)
  - add provides for all builtin modules (Tim Jackson, #173804)
  - own %{_libdir}/php/pear for PEAR packages (per #176733)
  - add obsoletes to allow upgrade from FE4 PDO packages (#181863)


author: Joe Orton <jorton@redhat.com> 5.1.4-5
changelog:
  - provide mod_php (#187891)
  - provide php-cli (#192196)
  - use correct LDAP fix (#181518)
  - define _GNU_SOURCE in php_config.h and leave it defined
  - drop (circular) dependency on php-pear


author: Joe Orton <jorton@redhat.com> 5.1.4-8
changelog:
  - Provide php-posix (#194583)
  - only provide php-pcntl from -cli subpackage
  - add missing defattr's (thanks to Matthias Saou)


author: Joe Orton <jorton@redhat.com> 5.2.0-3
changelog:
  - update to 5.2.0 (#213837)
  - php-xml provides php-domxml (#215656)
  - fix php-pdo-abi provide (#214281)


author: Joe Orton <jorton@redhat.com> 5.2.0-4
changelog:
  - provide php-zend-abi (#212804)
  - add /etc/rpm/macros.php exporting interface versions
  - synch with upstream recommended php.ini


author: Joe Orton <jorton@redhat.com> 5.2.0-5
changelog:
  - build json and zip shared, in -common (Remi Collet, #215966)
  - obsolete php-json and php-pecl-zip
  - build readline extension into /usr/bin/php* (#210585)
  - change module subpackages to require php-common not php (#177821)


author: Joe Orton <jorton@redhat.com> 5.2.0-9
changelog:
  - add php(api), php(zend-abi) provides (#221302)
  - package /usr/share/php and append to default include_path (#225434)


author: Joe Orton <jorton@redhat.com> 5.2.0-10
changelog:
  - bump default memory_limit to 32M (#220821)
  - mark config files noreplace again (#174251)
  - drop trailing dots from Summary fields
  - use standard BuildRoot
  - drop libtool15 patch (#226294)


author: Joe Orton <jorton@redhat.com> 5.2.3-3
changelog:
  - add mcrypt, mhash, tidy, mssql subpackages (Dmitry Butskoy)
  - enable dbase extension and package in -common


author: Joe Orton <jorton@redhat.com> 5.2.6-3
changelog:
  - update to 5.2.6
  - sync default php.ini with upstream
  - drop extension_dir from default php.ini, rely on hard-coded
    default, to make php-common multilib-safe (#455091)
  - update to r3 of systzdata patch


author: Joe Orton <jorton@redhat.com> 5.2.6-6
changelog:
  - move gd_README to php-gd
  - update to r4 of systzdata patch; introduces a default timezone
    name of "System/Localtime", which uses /etc/localtime (#469532)


author: Joe Orton <jorton@redhat.com> 5.2.8-4
changelog:
  - move wddx to php-xml, build curl shared in -common
  - remove BR for expat-devel, bogus configure option


author: Joe Orton <jorton@redhat.com> 5.2.8-9
changelog:
  - add recode support, -recode subpackage (#106755)
  - add -zts subpackage with ZTS-enabled build of httpd SAPI
  - adjust php.conf to use -zts SAPI build for worker MPM


author: Remi Collet <Fedora@famillecollet.com> 5.3.0-1
changelog:
  - update to 5.3.0
  - remove ncurses, dbase, mhash extensions
  - add enchant, sqlite3, intl, phar, fileinfo extensions
  - raise sqlite version to 3.6.0 (for sqlite3, build with --enable-load-extension)
  - sync with upstream "production" php.ini


author: Joe Orton <jorton@redhat.com> 5.3.0-2
changelog:
  - update to v5 of systzdata patch; parses zone.tab and extracts
    timezone->{country-code,long/lat,comment} mapping table


author: Remi Collet <Fedora@famillecollet.com> 5.3.1-1
changelog:
  - update to 5.3.1
  - remove openssl patch (merged upstream)
  - add provides for php-pecl-json
  - add prod/devel php.ini in doc


author: Remi Collet <Fedora@famillecollet.com> 5.3.2-1
changelog:
  - PHP 5.3.2 Released!
  - remove mime_magic option (now provided by fileinfo, by emu)
  - add patch for http://bugs.php.net/50578
  - remove patch for libedit (upstream)
  - add runselftest option to allow build without test suite


author: Remi Collet <remi@fedoraproject.org> 5.3.8-2
changelog:
  - add mysqlnd sub-package
  - drop patch4, use --libdir to use /usr/lib*/php/build
  - add patch to redirect mysql.sock (in mysqlnd)


author: Remi Collet <remi@fedoraproject.org> 5.3.8-3
changelog:
  - revert is_a() to php <= 5.3.6 behavior (from upstream)
    with new option (allow_string) for new behavior


author: Remi Collet <remi@fedoraproject.org> 5.4.0-0.3.RC7
changelog:
  - update to PHP 5.4.0RC7
  - provides env file for php-fpm (#784770)
  - add patch to use system libzip (thanks to spot)
  - don't provide INSTALL file


author: Remi Collet <remi@fedoraproject.org> 5.4.0-5
changelog:
  - fix Loadmodule with MPM event (use ZTS if not MPM worker)
  - split conf.d/php.conf + conf.modules.d/10-php.conf with httpd 2.4


author: Remi Collet <remi@fedoraproject.org> 5.4.4-1
changelog:
  - update to 5.4.4 (CVE-2012-2143, CVE-2012-2386)
  - use /usr/lib/tmpfiles.d instead of /etc/tmpfiles.d
  - use /run/php-fpm instead of /var/run/php-fpm


author: Remi Collet <rcollet@redhat.com> 5.4.7-8
changelog:
  - systemd integration, https://bugs.php.net/63085
  - no odbc call during timeout, https://bugs.php.net/63171
  - check sqlite3_column_table_name, https://bugs.php.net/63149


author: Remi Collet <remi@fedoraproject.org> 5.4.7-9
changelog:
  - php-fpm: enable PrivateTmp
  - php-fpm: new systemd macros (#850268)
  - php-fpm: add upstream patch for startup issue (#846858)


author: Remi Collet <rcollet@redhat.com> 5.4.7-2
changelog:
  - missing requires on scl-runtime
  - relocate /var/lib/session
  - fix php-devel requires
  - rename, but don't relocate macros.php


author: Remi Collet <rcollet@redhat.com> 5.4.7-3
changelog:
  - add configtest option to init script
  - test configuration before service reload
  - fix php-fpm service relocation
  - fix php-fpm config relocation
  - drop embdded subpackage for scl


author: Remi Collet <rcollet@redhat.com> 5.4.8-1
changelog:
  - update to 5.4.8
  - define both session.save_handler and session.save_path
  - fix possible segfault in libxml (#828526)
  - use SKIP_ONLINE_TEST during make test
  - php-devel requires pcre-devel and php-cli (instead of php)
  - provides php-phar
  - update systzdata patch to v10, timezone are case insensitive


author: Remi Collet <rcollet@redhat.com> 5.4.8-1.2
changelog:
  - minor macro fixes for RHEL-5 build
  - update autotools workaround for RHEL-5
  - use readline when libedit not available (RHEL-5)


author: Remi Collet <rcollet@redhat.com> 5.4.8-2.1
changelog:
  - make php-enchant optionnal, not available on RHEL-5
  - make php-recode optionnal, not available on RHEL-5
  - disable t1lib on RHEL-5


author: Remi Collet <rcollet@redhat.com> 5.4.8-6
changelog:
  - clarify Licenses
  - missing provides xmlreader and xmlwriter
  - change php embedded library soname version to 5.4


author: Remi Collet <rcollet@redhat.com> 5.4.8-6
changelog:
  - filter private shared in _httpd_modir
  - improve system libzip patch to use pkg-config
  - use _httpd_contentdir macro and fix php.gif path
  - switch back to upstream generated scanner/parser
  - use system pcre only when recent enough


author: Remi Collet <rcollet@redhat.com> 5.4.10-1
changelog:
  - update to 5.4.10
  - remove patches merged upstream
  - drop "Configure Command" from phpinfo output
  - prevent php_config.h changes across (otherwise identical)
    rebuilds


author: Remi Collet <rcollet@redhat.com> 5.4.13-1
changelog:
  - update to 5.4.13
  - security fixes for CVE-2013-1635 and CVE-2013-1643
  - make php-mysql package optional (and disabled)
  - make ZTS build optional (and disabled)
  - always try to load mod_php (apache warning is usefull)
  - Hardened build (links with -z now option)
  - Remove %config from /etc/rpm/macros.php


author: Remi Collet <rcollet@redhat.com> 5.4.14-2
changelog:
  - rebuild for libjpeg (instead of libjpeg_turbo)
  - fix unowned dir %{_datadir}/fpm and %{_libdir}/httpd (#956221)


author: Remi Collet <rcollet@redhat.com> 5.4.16-1
changelog:
  - rebase to 5.4.16
  - fix hang in FindTishriMolad(), #965144
  - patch for upstream Bug #64915 error_log ignored when daemonize=0
  - patch for upstream Bug #64949 Buffer overflow in _pdo_pgsql_error, #969103
  - patch for upstream bug #64960 Segfault in gc_zval_possible_root


author: Remi Collet <rcollet@redhat.com> 5.4.16-4
changelog:
  - improve mod_php, pgsql and ldap description
  - add missing man pages (phar, php-cgi)
  - add provides php(pdo-abi) for consistency with php(api) and php(zend-abi)
  - use %__isa_bits instead of %__isa in ABI suffix #985350


author: Remi Collet <rcollet@redhat.com> 5.4.16-8
changelog:
  - relocate RPM macro #1008483
  - remove ZTS conditional stuf for ligibility
  - add mod_php for httpd24 collection


author: Remi Collet <rcollet@redhat.com> - 5.4.16-18
changelog:
  - fix heap-based buffer over-read in DateInterval CVE-2013-6712
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
    CVE-2014-2497
  - gd: fix NUL byte injection in file names. CVE-2014-5120
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - core: fix heap-based buffer overflow in DNS TXT record
    parsing. CVE-2014-4049
  - network: fix segfault in dns_get_record
    (incomplete fix for CVE-2014-4049). CVE-2014-3597
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - core: unserialize() SPL ArrayObject / SPLObjectStorage
    type confusion flaw. CVE-2014-3515
  - fileinfo: fix infinite recursion. CVE-2014-1943
  - fileinfo: fix out-of-bounds memory access. CVE-2014-2270
  - fileinfo: fix extensive backtracking CVE-2013-7345
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238
  - fileinfo: cdf_read_short_sector insufficient boundary
    check. CVE-2014-0207
  - fileinfo: fix extensive backtracking in regular expression
    (incomplete fix for CVE-2013-7345). CVE-2014-3538
  - fileinfo: cdf_check_stream_offset insufficient boundary
    check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check
    CVE-2014-3480
  - fileinfo: fix mconvert incorrect handling of truncated
    pascal string size. CVE-2014-3478
  - fileinfo: cdf_read_property_info insufficient boundary
    check. CVE-2014-3487
  - fileinfo: fix cdf_read_property_info
    (incomplete fix for CVE-2012-1571). CVE-2014-3587


author: Remi Collet <rcollet@redhat.com> - 5.4.16-20
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.4.45-10
changelog:
  - Added imap extension for all CentOS versions.  It now depends on
    our internal SCL libc-client package.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.4.45-11
changelog:
  - mod_php adjusted to conflict with other mod_php versions, and
    not itself.  this lets the user reinstall the package without
    conflict. (ZC-1459)


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 5.4.45-21.cloudlinux.2
changelog:
  - add HardenedPHP patches:
  -   CVE-2016-7412: Heap overflow in mysqlnd related to BIT fields
  -   CVE-2016-7413: wddx_deserialize use-after-free
  -   CVE-2016-7414: Out of bound when verify signature of zip phar in phar_parse_zipfile
  -   CVE-2016-7416: SEH buffer overflow msgfmt_format_message
  -   CVE-2016-7417: Missing type check when unserializing SplArray
  -   CVE-2016-7418: Out-Of-Bounds Read in php_wddx_push_element of wddx.c
  -   security bug #72837: integer overflow in bzdecompress caused heap corruption (bz2)
      http://bugs.php.net/72837
  -   security bug #70436: Use After Free Vulnerability in unserialize() (core)
      http://bugs.php.net/70436
  -   security bug #72633: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization (core)
      http://bugs.php.net/72663
  -   security bug #72681: PHP Session Data Injection Vulnerability (core)
      http://bugs.php.net/72681
  -   security bug #72807: integer overflow in curl_escape caused heap corruption (curl)
      http://bugs.php.net/72807
  -   security bug #72838: Integer overflow lead to heap corruption in sql_regcase (ereg)
      http://bugs.php.net/72838
  -   security bug #72697: select_colors write out-  of-   bounds (gd)
      http://bugs.php.net/7- 2697
  -   security bug #72730: imagegammacorrect allows arbitrary write access (gd)
      http://bugs.php.net/72730
  -   security bug #72708: php_snmp_parse_oid integer overflow in memory allocation (snmp)
      http://bugs.php.net/72708
  -   security bug #72836: integer overflow in base64_decode caused heap corruption (standard)
      http://bugs.php.net/72836
  -   security bug #72848: integer overflow in quoted_printable_encode caused heap corruption (standard)
      http://bugs.php.net/72848
  -   security bug #72849: integer overflow in urlencode caused heap corruption (standard)
      http://bugs.php.net/72849
  -   security bug #72850: integer overflow in php_uuencode caused heap corruption (standard)
      http://bugs.php.net/72850
  -   security bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack (streams)
      http://bugs.php.net/72771
  -   security bug #72749: wddx_deserialize allows illegal memory access (wddx)
      http://bugs.php.net/72749
  -   security bug #72750: wddx_deserialize null dereference (wddx)
      http://bugs.php.net/72750
  -   security bug #72790: wddx_deserialize null dereference with invalid xml (wddx)
      http://bugs.php.net/72790
  -   security bug #72799: wddx_deserialize null dereference in php_wddx_pop_element (wddx)
      http://bugs.php.net/72799
  -   CVE-2016-5399: Inadequate error handling in bzread()
      http://bugs.php.net/72613
  -   CVE-2016-6288: php_url_parse_ex() buffer overflow read
      http://bugs.php.net/70480
  -   CVE-2016-6289: Stack-based buffer overflow vulnerability in virtual_file_ex
      http://bugs.php.net/72513
  -   CVE-2016-6290: Use After Free in unserialize() with Unexpected Session Deserialization
      http://bugs.php.net/72562
  -   CVE-2016-6291: Out of bound read in exif_process_IFD_in_MAKERNOTE
      http://bugs.php.net/72603
  -   CVE-2016-6292: NULL Pointer Dereference in exif_process_user_comment
      http://bugs.php.net/72618
  -   CVE-2016-6294: locale_accept_from_http out-of-bounds access
      http://bugs.php.net/72533
  -   CVE-2015-8879: PHP segfaults when accessing nvarchar(max) defined columns
      http://bugs.php.net/69975
  -   CVE-2016-6295: Use After Free Vulnerability in SNMP with GC and unserialize()
      http://bugs.php.net/72479
  -   CVE-2016-6296: heap-buffer-overflow (write) simplestring_addn simplestring.c
      http://bugs.php.net/72606
  -   CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener
      http://bugs.php.net/72520
  -   CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow
      https://bugs.php.net/bug.php?id=72339
  -   CVE-2016-5768: _php_mb_regex_ereg_replace_exec - double free
      https://bugs.php.net/bug.php?id=72402
  -   CVE-2016-5771: Use After Free Vulnerability in PHP's GC algorithm and unserialize
      https://bugs.php.net/bug.php?id=72433
  -   CVE-2016-5772: Double Free Corruption in wddx_deserialize
      https://bugs.php.net/bug.php?id=72340
  -   CVE-2016-5773: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
      https://bugs.php.net/bug.php?id=72434
  -   CVE-2015-8874: Stack overflow with imagefilltoborder
      https://bugs.php.net/bug.php?id=66387
  -   CVE-2016-4343: (phar) uninitialized pointer in phar_make_dirstream()
      https://bugs.php.net/71331
  -   CVE-2016-5093: (intl) get_icu_value_internal out-of-bounds read
      https://bugs.php.net/72241
  -   CVE-2016-5094: (core) integer overflow in php_html_entities
      https://bugs.php.net/72135
  -   CVE-2016-5096: (core) integer underflow / arbitrary null write in fread/gzread
      https://bugs.php.net/72114
  -   security bug 72099: xml_parse_into_struct segmentation fault (CVE-2016-4539)
      https://bugs.php.net/bug.php?id=72099
  -   security bug 72061: Out-of-bounds reads in zif_grapheme_stripos with negative offset (CVE-2016-4540, CVE-2016-4541)
      https://bugs.php.net/bug.php?id=72061
  -   security bug 71912: libgd: signedness vulnerability (CVE-2016-3074)
      https://bugs.php.net/bug.php?id=71912
  -   security bug 72094: Out of bounds heap read access in exif header processing (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
      https://bugs.php.net/bug.php?id=72094
  -   security bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition (CVE-2016-4537, CVE-2016-4538)
      https://bugs.php.net/bug.php?id=72093
  -   security bug 72099: xml_parse_into_struct segmentation fault (CVE-2016-4539)
      https://bugs.php.net/bug.php?id=72099
  -   security bug 72061: Out-of-bounds reads in zif_grapheme_stripos with negative offset (CVE-2016-4540, CVE-2016-4541)
      https://bugs.php.net/bug.php?id=72061
  -   security bug 71912: libgd: signedness vulnerability (CVE-2016-3074)
      https://bugs.php.net/bug.php?id=71912
  -   security bug 72094: Out of bounds heap read access in exif header processing (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
      https://bugs.php.net/bug.php?id=72094
  -   security bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition (CVE-2016-4537, CVE-2016-4538)
      https://bugs.php.net/bug.php?id=72093
  -   security bug 71860: Invalid memory write in phar on filename with \0 in name
      https://bugs.php.net/bug.php?id=71860
  -   security bug 71704: php_snmp_error() Format String Vulnerability
      https://bugs.php.net/bug.php?id=71704
  -   security bug 71798: Integer Overflow in php_raw_url_encode
      https://bugs.php.net/bug.php?id=71798
  -   security bug 71860: Invalid memory write in phar on filename with \0 in name
      https://bugs.php.net/bug.php?id=71860
  -   security bug 71704: php_snmp_error() Format String Vulnerability
      https://bugs.php.net/bug.php?id=71704
  -   security bug 71798: Integer Overflow in php_raw_url_encode
      https://bugs.php.net/bug.php?id=71798
  -   security bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
      https://bugs.php.net/bug.php?id=71587
  -   security bug #71498: Out-of-Bound Read in phar_parse_zipfile()
      https://bugs.php.net/bug.php?id=71498
  -   security bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
      https://bugs.php.net/bug.php?id=71587
  -   security bug #71498: Out-of-Bound Read in phar_parse_zipfile()
      https://bugs.php.net/bug.php?id=71498
  -   bug 64343: PharData::extractTo fails for tarball created by BSD tar
  -   security bug #71039: exec functions ignore length but look for NULL termination
  -   security bug #71323: Output of stream_get_meta_data can be falsified by its input
  -   security bug #71354: Heap corruption in tar/zip/phar parser.
  -   security bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
  -   security bug #71459: Integer overflow in iptcembed()
  -   security bug #71488: Stack overflow when decompressing tar archives
  -   bug 64343: PharData::extractTo fails for tarball created by BSD tar
  -   security bug #71039: exec functions ignore length but look for NULL termination
  -   security bug #71323: Output of stream_get_meta_data can be falsified by its input
  -   security bug #71354: Heap corruption in tar/zip/phar parser.
  -   security bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
  -   security bug #71459: Integer overflow in iptcembed()
  -   security bug #71488: Stack overflow when decompressing tar archives
  -   bug70661: Use After Free Vulnerability in WDDX Packet Deserialization
  -   bug70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
  -   bug70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()
  -   bug70755: fpm_log.c memory leak and buffer overflow
  -   add patches for bugs 69720 (https://bugs.php.net/bug.php?id=69720) and 70433 (https://bugs.php.net/bug.php?id=70433)


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.4.45-22.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  -   security bug 73189: memcpy negative size parameter php_resolve_path
  -   security bug 73190: memcpy negative parameter _bc_new_num_ex
  -   security bug 73150: missing NULL check in dom_document_save_html
  -   security bug 73284: heap overflow in php_ereg_replace function
  -   security bug 73218: stack-buffer-overflow through "ResourceBundle" methods
  -   security bug 73208: integer overflow in imap_8bit caused heap corruption
  -   security bug 73082: string length overflow in mb_encode_* function
  -   security bug 73174: heap overflow in php_pcre_replace_impl
  -   security bug 73276: crash in openssl_random_pseudo_bytes function
  -   security bug 73275: crash in openssl_encrypt function
  -   security bug 73017: memory corruption in wordwrap function
  -   security bug 73240: Write out of bounds at number_format
  -   security bug 73073: CachingIterator null dereference when convert to string
  -   security bug 73293: NULL pointer dereference in SimpleXMLElement::asXML()


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.4.45-25.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: bug 71465: PHAR doesn't know about litespeed


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.4.45-25.cloudlinux.2
changelog:
  - add HaredenedPHP patches:
  -   bug 73764: Crash while loading hostile phar archive (CVE-2016-10159)
  -   bug 73768: Memory corruption when loading hostile phar (CVE-2016-10160)
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 68447: grapheme_extract take an extra trailing character
  -   bug 70213: Unserialize context shared on double class lookup
  -   bug 73549: Use after free when stream is passed to imagepng
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73773: Seg fault when loading hostile phar
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.4.45-28.cloudlinux.1
changelog:
  - add HaredenedPHP patches:
  -   bug 71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut (CVE-2016-4073)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.4.45-38.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug70436: Use After Free Vulnerability in unserialize()
  - bug74087: Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Cory McIntire <cory@cpanel.net> - 5.4.45-52
changelog:
  * Mon Mar 20 2018 Cory McIntire <cory@cpanel.net> - 5.4.45-52
  - ZC-3552: Added versioning to ea-openssl and libcurl requirements.


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.4.45-56.cloudlinux.4
changelog:
  - Fix bug #77242: heap out of bounds read in xmlrpc_decode()
  - Fix bug #77247: heap buffer overflow in phar_detect_phar_fname_ext
  - Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node
  - Fix bug #77380: Global out of bounds read in xmlrpc base64 code
  - Fix bug #77418: Heap overflow in utf32be_mbc_to_code


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.4.45-60.cloudlinux.1
changelog:
  - Fixed bug #50020 (DateInterval:createDateFromString() silently fails)
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77664 (Segmentation fault when using undefined constant in custom wrapper)
  - Fix bug #77677: WCOREDUMP not available on all systems
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77722
  - Fixed bug #77742
  - Fixed bug #77765
  - Fix #77921: static.php.net doesn't work anymore
  - Fix bug #77934 (php-fpm kill -USR2 not working)
  - Fix #77943: imageantialias($image, false); does not work
  - Fix #77944: Wrong meta pdo_type for bigint on LLP64
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.4.45-63.cloudlinux.2
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #75457: heap-use-after-free
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.4.45-66.cloudlinux.3
changelog:
  - Fix bug #79099: OOB read in php_strip_tags_ex (CVE-2020-7059)
  - Fix bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar` (CVE-2020-7060)
  - Fix bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)
  - Fix bug #79221: Null Pointer Dereference in PHP Session Upload Progress (CVE-2020-7062)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.4.45-69.cloudlinux.1
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #75673: SplStack::unserialize() behavior
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 5.4.45-70.cloudlinux.1
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached


author: Daniil Leonov <dleonov@cloudlinux.com> - 5.4.45-72.cloudlinux.2
changelog:
  - Fix Bug #73809: Phar Zip parse crash - mmap fail
  - Fix Bug #77322: PharData::addEmptyDir('/') Possible integer overflow
  - Fix Bug #77961: Slow reqursive functions with MySQL
  - Fix Bug #80366: Potential issue in ext/standard/iptc.c: Return Value Not Checked


author: Remi Collet <rcollet@redhat.com> 5.5.4-1
changelog:
  - update to PHP 5.5.4
  - improve security, use specific soap.wsdl_cache_dir
    use /var/lib/php/wsdlcache for mod_php and php-fpm
  - sync short_tag comments in php.ini with upstream
  - relocate RPM macro


author: Remi Collet <rcollet@redhat.com> - 5.5.6-8
changelog:
  - fix patch name
  - fix memory leak introduce in patch for CVE-2014-1943
  - fix heap-based buffer over-read in DateInterval CVE-2013-6712


author: Remi Collet <rcollet@redhat.com> - 5.5.6-9
changelog:
  - gd: fix NULL deref in imagecrop CVE-2013-7327
  - gd: drop vpx support, fix huge memory consumption #1075201


author: Remi Collet <rcollet@redhat.com> - 5.5.6-10
changelog:
  - fileinfo: fix out-of-bounds memory access CVE-2014-2270
  - fileinfo: fix extensive backtracking CVE-2013-7345


author: Remi Collet <rcollet@redhat.com> - 5.5.6-11
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
    CVE-2014-2497
  - gd: fix NUL byte injection in file names. CVE-2014-5120
  - core: fix heap-based buffer overflow in DNS TXT record
    parsing. CVE-2014-4049
  - network: fix segfault in dns_get_record
    (incomplete fix for CVE-2014-4049). CVE-2014-3597
  - core: unserialize() SPL ArrayObject / SPLObjectStorage
    type confusion flaw. CVE-2014-3515
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238
  - fileinfo: cdf_read_short_sector insufficient boundary
    check. CVE-2014-0207
  - fileinfo: fix extensive backtracking in regular expression
    (incomplete fix for CVE-2013-7345). CVE-2014-3538
  - fileinfo: cdf_check_stream_offset insufficient boundary
    check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check
    CVE-2014-3480
  - fileinfo: fix mconvert incorrect handling of truncated
    pascal string size. CVE-2014-3478
  - fileinfo: cdf_read_property_info insufficient boundary
    check. CVE-2014-3487
  - fileinfo: fix cdf_read_property_info
    (incomplete fix for CVE-2012-1571). CVE-2014-3587


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.5.22-1
changelog:
  - Set imap and recode to be incompatible
  - developer version of opcache.ini is distributed instead of auto-gen


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:5.5.31-1.2.cloudlinux
changelog:
  - php-fpm.5.dl.patch applied
  - build with LSAPI 6.9
  - added explicit declaration for debuginfo package
  - Epoch bumped to 1
  - Vendor removed
  - dist macro added to Release


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 5.5.38-4.cloudlinux
changelog:
  - add HardenedPHP patches:
  -   CVE-2016-7411: Memory Corruption in During Deserialized-object Destruction
  -   CVE-2016-7412: Heap overflow in mysqlnd related to BIT fields
  -   CVE-2016-7413: wddx_deserialize use-after-free
  -   CVE-2016-7414: Out of bound when verify signature of zip phar in phar_parse_zipfile
  -   CVE-2016-7416: SEH buffer overflow msgfmt_format_message
  -   CVE-2016-7417: Missing type check when unserializing SplArray
  -   CVE-2016-7418: Out-Of-Bounds Read in php_wddx_push_element of wddx.c
  -   security bug #72837: integer overflow in bzdecompress caused heap corruption (bz2)
      http://bugs.php.net/72837
  -   security bug #70436: Use After Free Vulnerability in unserialize() (core)
      http://bugs.php.net/70436
  -   bug #72024: microtime() leaks memory (core)
      http://bugs.php.net/72024
  -   security bug #72633: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization (core)
      http://bugs.php.net/72663
  -   security bug #72681: PHP Session Data Injection Vulnerability (core)
      http://bugs.php.net/72681
  -   security bug #72807: integer overflow in curl_escape caused heap corruption (curl)
      http://bugs.php.net/72807
  -   security bug #72838: Integer overflow lead to heap corruption in sql_regcase (ereg)
      http://bugs.php.net/72838
  -   security bug #72697: select_colors write out-of-bounds (gd)
      http://bugs.php.net/72697
  -   security bug #72730: imagegammacorrect allows arbitrary write access (gd)
      http://bugs.php.net/72730
  -   security bug #72708: php_snmp_parse_oid integer overflow in memory allocation (snmp)
      http://bugs.php.net/72708
  -   security bug #72836: integer overflow in base64_decode caused heap corruption (standard)
      http://bugs.php.net/72836
  -   security bug #72848: integer overflow in quoted_printable_encode caused heap corruption (standard)
      http://bugs.php.net/72848
  -   security bug #72849: integer overflow in urlencode caused heap corruption (standard)
      http://bugs.php.net/72849
  -   security bug #72850: integer overflow in php_uuencode caused heap corruption (standard)
      http://bugs.php.net/72850
  -   security bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack (streams)
      http://bugs.php.net/72771
  -   security bug #72749: wddx_deserialize allows illegal memory access (wddx)
      http://bugs.php.net/72749
  -   security bug #72750: wddx_deserialize null dereference (wddx)
      http://bugs.php.net/72750
  -   security bug #72790: wddx_deserialize null dereference with invalid xml (wddx)
      http://bugs.php.net/72790
  -   security bug #72799: wddx_deserialize null dereference in php_wddx_pop_element (wddx)
      http://bugs.php.net/72799


author: Dmitry Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-4.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  -   security bug 73189: Memcpy negative size parameter php_resolve_path
  -   security bug 73147: Use After Free in unserialize()
  -   security bug 73190: memcpy negative parameter _bc_new_num_ex
  -   security bug 73150: missing NULL check in dom_document_save_html
  -   security bug 73284: heap overflow in php_ereg_replace function
  -   CVE-2016-7568: Integer Overflow in gdImageWebpCtx of gd_webp.c
  -   security bug 73218: stack-buffer-overflow through "ResourceBundle" methods
  -   security bug 73208: integer overflow in imap_8bit caused heap corruption
  -   security bug 73082: string length overflow in mb_encode_* function
  -   security bug 73174: heap overflow in php_pcre_replace_impl
  -   security bug 73276: crash in openssl_random_pseudo_bytes function
  -   security bug 73275: crash in openssl_encrypt function
  -   security bug 73017: memory corruption in wordwrap function
  -   security bug 73240: Write out of bounds at number_format
  -   security bug 73073: CachingIterator null dereference when convert to string
  -   security bug 73293: NULL pointer dereference in SimpleXMLElement::asXML()


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-11.cloudlinux.1
changelog:
  - add HaredenedPHP patches:
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess


author: Dmtriy Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-11.cloudlinux.3
changelog:
  - ALTPHP-318: bug 69090: opcache: add prefix/xor to cache keys/check permissions or separate caches
  - ALTPHP-323: LSPHP: CRIU support added


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-22.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug74087: Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Cory McIntire <cory@cpanel.net> - 5.5.38-35
changelog:
  * Mon Mar 20 2018 Cory McIntire <cory@cpanel.net> - 5.5.38-35
  - ZC-3552: Added versioning to ea-openssl and ea-libcurl requirements.


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.5.38-39.cloudlinux.4
changelog:
  - Fix bug #77242: heap out of bounds read in xmlrpc_decode()
  - Fix bug #77247: heap buffer overflow in phar_detect_phar_fname_ext
  - Fix bug #77269: Potential unsigned underflow in gdImageScale
  - Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node
  - Fix bug #77380: Global out of bounds read in xmlrpc base64 code
  - Fix bug #77418: Heap overflow in utf32be_mbc_to_code


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.5.38-46.cloudlinux.1
changelog:
  - Fix bug #77124
  - Fix bug #78192 PDO SQLite SegFault when reuse statement after schema has changed
  - Fix #78212: Segfault in built-in webserver
  - Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
  - Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  - Fixed bug #78279
  - Fixed bug #78297


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.5.38-46.cloudlinux.2
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #75457: heap-use-after-free
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast
  - Fix #78342: Bus error in configure test for iconv //IGNORE


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.5.38-52.cloudlinux.2
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79497: stream_socket_client() throws an unknown error sometimes with <1s timeout
  - Fix bug #79514: Memory leaks while including unexistent file
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.6.6-1
changelog:
  - Set imap and recode to be incompatible
  - Added libzip compile flags, but set to incompatible with all
    current versions of CentOS (e.g. <= 7).  RHEL patches PHP to
    be compatible with the version of libzip that's supplied by
    them.
  - developer version of opcache.ini is distributed instead of auto-gen


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.6.30-1.cloudlinux.2
changelog:
  - ALTPHP-306: LSPHP: Return response code and response status line in cgi/fcgi manner
  - Update CRIU patch to version 7
  - Supress warnings about deprecated $HTTP_RAW_POST_DATA


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.31-1.cloudlinux.1
changelog:
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Cory McIntire <cory@cpanel.net> - 5.6.34-3
changelog:
  * Mon Mar 20 2018 Cory McIntire <cory@cpanel.net> - 5.6.34-3
  - ZC-3552: Added versioning to ea-openssl and ea-libcurl requirements.


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-5.cloudlinux.1
changelog:
  - Fixed bug #50020 (DateInterval:createDateFromString() silently fails)
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77597
  - Fixed bug #77664 (Segmentation fault when using undefined constant in custom wrapper)
  - Fix bug #77677: WCOREDUMP not available on all systems
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77722
  - Fixed bug #77742
  - Fixed bug #77765
  - Fix #77767: phpdbg break command help message shows incorrect aliases
  - Fix #77921: static.php.net doesn't work anymore
  - Fix bug #77934 (php-fpm kill -USR2 not working)
  - Fix #77943: imageantialias($image, false); does not work
  - Fix #77944: Wrong meta pdo_type for bigint on LLP64
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-5.cloudlinux.2
changelog:
  - Fix bug #77967 - Bypassing open_basedir restrictions via file uris
  - Fix #77973: Uninitialized read in gdImageCreateFromXbm
  - Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
  - Fix bug #78069 - Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-8.cloudlinux.1
changelog:
  - Fix bug #77124
  - Fix bug #78192 PDO SQLite SegFault when reuse statement after schema has changed
  - Fix #78202: Opcache stats for cache hits are capped at 32bit NUM
  - Fix #78212: Segfault in built-in webserver
  - Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
  - Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  - Fixed bug #78279
  - Fixed bug #78297


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-8.cloudlinux.2
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #75457: heap-use-after-free
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast
  - Fix #78342: Bus error in configure test for iconv //IGNORE
  - Fix #78379: (Cast to object confuses GC, causes crash)


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-9.cloudlinux.3
changelog:
  - Fix #76342: file_get_contents waits twice specified timeout
  - Fix #76859 stream_get_line skips data if used with data-generating filter
  - Fix #78413: php-fpm request_terminate_timeout does not take effect after fastcgi_finish_request
  - Fix #78579: mb_decode_numericentity: args number inconsistency
  - Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)


author: Remi Collet <rcollet@redhat.com> - 5.6.0-0.1.RC4
changelog:
  - initial spec for PHP 5.6 as Software Collection
  - adapted from php 5.6 spec file from remi repository
  - adapted from php 5.5 spec file from rhscl 1.1


author: Remi Collet <remi@fedoraproject.org> 5.6.1-1
changelog:
  - Update to PHP 5.6.1
    http://php.net/releases/5_6_1.php
  - use default system cipher list by Fedora policy
    http://fedoraproject.org/wiki/Changes/CryptoPolicy
  - add system php library to default include_path


author: Remi Collet <remi@fedoraproject.org> 5.6.3-0.1.RC1
changelog:
  - update to 5.6.3RC1
  - new version of systzdata patch, fix case sensitivity
  - ignore Factory in date tests
  - disable opcache.fast_shutdown in default config
  - add php56-cgi command in base system


author: Remi Collet <remi@fedoraproject.org> 5.6.3-2
changelog:
  - FPM: add upstream patch for https://bugs.php.net/68421
    access.format=R doesn't log ipv6 address
  - FPM: add upstream patch for https://bugs.php.net/68420
    listen=9000 listens to ipv6 localhost instead of all addresses
  - FPM: add upstream patch for https://bugs.php.net/68423
    will no longer load all pools


author: Remi Collet <remi@fedoraproject.org> 5.6.4-2
changelog:
  - Update to 5.6.4
    http://www.php.net/releases/5_6_4.php
  - add sybase_ct extension (in mssql sub-package)
  - xmlrpc requires xml


author: Remi Collet <remi@fedoraproject.org> 5.6.5-0.1.RC1
changelog:
  - update to 5.6.5RC1
  - add base system path in default include path
  - FPM: enable ACL for Unix Domain Socket


author: Remi Collet <remi@fedoraproject.org> 7.0.0-0.1.20150325git23336d7
changelog:
  - update for php 7.0.0
  - ereg, mssql, mysql and sybase_ct extensions are removed
  - add pdo-dblib subpackage (instead of php-mssql)
  - disable oci8 extension, not yet adapted for 7.0
  - add php-zip subpackage
  - add php-json subpackage


author: Remi Collet <remi@fedoraproject.org> 7.0.0-0.15.RC2
changelog:
  - Update to 7.0.0RC2
  - enable oci8 and pdo_oci extensions
  - sync php.ini with upstream php.ini-production


author: Remi Collet <remi@fedoraproject.org> 7.0.0-0.19.RC5
changelog:
  - Update to 7.0.0RC5
  - update php-fpm.d/www.conf comments
  - API and Zend API are now set to 20151012


author: Remi Collet <remi@fedoraproject.org> 7.0.0-0.26.RC8
changelog:
  - set opcache.huge_code_pages=0 on EL-6
    see  https://bugs.php.net/70973 and https://bugs.php.net/70977


author: S. Kurt Newman <kurt.newman@cpanel.net> - 7.0.0-4
changelog:
  - Update spec to reflect how cpanel deploys its other php packages.
  - Disable file-based opcaching for cpanel because it introduces
    security concerns and incompatibilities on multi-user systems.


author: Daniel Muey <dan@cpanel.net> - 7.0.8-1
changelog:
  - Updated to version 7.0.8 via update_pkg.pl (EA-4738)
  - Remove opcache check since it was removed in d41920c (EA-4755)


author: S. Kurt Newman <kurt.newman@cpanel.net> - 7.0.9-2
changelog:
  - Removed reference to unused patches.
  - Used prior choon.net mail-header patch as a basis for updating
    it with PHP 7 compatibility (EA-4199).


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:7.0.15-1.cloudlinux.2
changelog:
  - ALTPHP-306: LSPHP: Return response code and response status line in cgi/fcgi manner
  - Update CRIU patch to version 7


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-2.cloudlinux2.1
changelog:
  - Fix #77269: Potential unsigned underflow in gdImageScale
  - Fix #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77370 - check that we do not read past buffer end when parsing multibytes
  - Fix bug #77371 (heap buffer overflow in mb regex functions - compile_string_node)
  - Fix bug #77418 - Heap overflow in utf32be_mbc_to_code
  - Fix bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext)
  - Fix bug #77242 (heap out of bounds read in xmlrpc_decode())
  - Fix bug #77380  (Global out of bounds read in xmlrpc base64 code)


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-6.cloudlinux.1
changelog:
  - Fixed bug #50020 (DateInterval:createDateFromString() silently fails)
  - Fixed bug #75113: Added DatePeriod::getRecurrences() method.
  - Fixed bug #75186
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77597
  - fail on 7.2, but I'm fixing this here anyway as the code is clearly
  - Fixed bug #77652
  - Fixed bug #77660 (Segmentation fault on break 2147483648)
  - Fixed bug #77664 (Segmentation fault when using undefined constant in custom wrapper)
  - Fix bug #77677: WCOREDUMP not available on all systems
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77722
  - Fixed bug #77738 (Nullptr deref in zend_compile_expr)
  - Fixed bug #77742
  - Fixed bug #77765
  - Fixed bug #75186
  - Fixed bug #76717
  - Fix #77767: phpdbg break command help message shows incorrect aliases
  - Fixed bug #77843
  - Fix #77921: static.php.net doesn't work anymore
  - Fix bug #77934 (php-fpm kill -USR2 not working)
  - Fix #77943: imageantialias($image, false); does not work
  - Fix #77944: Wrong meta pdo_type for bigint on LLP64
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-9.cloudlinux.1
changelog:
  - Fix bug #77124
  - Fix #77919: Potential UAF in Phar RSHUTDOWN
  - Fix #78173: XML-RPC mutates immutable objects during encoding
  - Fix bug #78192 PDO SQLite SegFault when reuse statement after schema has changed
  - Fix #78202: Opcache stats for cache hits are capped at 32bit NUM
  - Fix #78212: Segfault in built-in webserver
  - Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
  - Fix #78241: touch() does not handle dates after 2038 in PHP 64-bit
  - Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  - Fixed bug #78279
  - Fix bug #78291 Missing opcache directives
  - Fixed bug #78297


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-9.cloudlinux.2
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #75457: heap-use-after-free
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78282: atime and mtime mismatch
  - Fix #78326: improper memory deallocation on stream_get_contents
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast
  - Fix #78342: Bus error in configure test for iconv //IGNORE
  - Fix #78379: (Cast to object confuses GC, causes crash)


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-10.cloudlinux.3
changelog:
  - Fix #76342: file_get_contents waits twice specified timeout
  - Fix #76859 stream_get_line skips data if used with data-generating filter
  - Fix #78413: php-fpm request_terminate_timeout does not take effect after fastcgi_finish_request
  - Fix #78535: auto_detect_line_endings value not parsed as bool
  - Fix #78579: mb_decode_numericentity: args number inconsistency
  - Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)
  - Fixed bug #78612
  - Fix #78620: Out of memory error
  - Fix #78641: addGlob can modify given remove_path value


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-11.cloudlinux.1
changelog:
  - Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer)
  - Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
  - Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
  - Fixed bug #78863 (DirectoryIterator class silently truncates after a nullbyte). (CVE-2019-11045)
  - Fixed bug #78862 (link() silently truncates after a null byte on Windows). (CVE-2019-11044)
  - Updated Litespeed SAPI to 7.6


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-12.cloudlinux.3
changelog:
  - Fix bug #77569: Write Access Violation in DomImplementation
  - Fix bug #79078: Hypothetical use-after-free in curl_multi_add_handle
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.0.33-15.cloudlinux.1
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #75673: SplStack::unserialize() behavior
  - Fix bug #79199: curl_copy_handle() memory leak
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79393: Null coalescing operator failing with SplFixedArray
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)
  - Fix bug #79468: SIGSEGV when closing stream handle with a stream filter appended


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.0.33-15.cloudlinux.2
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79497: stream_socket_client() throws an unknown error sometimes with <1s timeout
  - Fix bug #79503: Memory leak on duplicate metadata
  - Fix bug #79514: Memory leaks while including unexistent file
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.0.33-16.cloudlinux.2
changelog:
  - Fix bug #62890: default_socket_timeout=-1 causes connection to timeout
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79783: Segfault in php_str_replace_common
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79797: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.0.33-16.cloudlinux.4
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)
  - Fix bug #79825: opcache.file_cache causes SIGSEGV when custom opcode handlers changed
  - Fix bug #79986: str_ireplace bug with diacritics characters
  - Fix bug #80007: Potential type confusion in unixtojd() parameter parsing
  - Fix bug #80049: Memleak when coercing integers to string via variadic argument


author: Daniil Leonov <dleonov@cloudlinux.com> - 7.0.33-19-cloudlinux.2
changelog:
  - Fix Bug #73809: Phar Zip parse crash - mmap fail
  - Fix Bug #77322: PharData::addEmptyDir('/') Possible integer overflow
  - Fix Bug #77961: Slow reqursive functions with MySQL
  - Fix Bug #80366: Potential issue in ext/standard/iptc.c: Return Value Not Checked
  - Fix Bug #80411: References to null-serialized object break serialize()


author: Jacob Perkins <jacob.perkins@cpanel.net> - 7.1.0-alpha3
changelog:
  * Mon Jun 27 2016 Daniel Muey <dan@cpanel.net> - 7.0.8-1
  - Updated to version 7.0.8 via update_pkg.pl (EA-4738)
  - Remove opcache check since it was removed in d41920c (EA-4755)


author: Edwin Buck <e.buck@cpanel.net> - 7.1.0-2.beta1
changelog:
  - Updated to PHP 7.1 (beta) sources
  - Added php imap support
  - Applied fpm and updated mail header patches


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:7.1.0-4.beta3.cloudlinux
changelog:
  - epoch bumped to 1
  - cPanel vendor removed
  - php-7.0.x-ea4-ini.patch disabled because it breaks mod_lsapi in some cases
  - php-fpm.7.1.dl.v2.patch patch applied
  - php-5.6.10-litespeed-sa_mask.patch patch applied
  - lsapi-6.9-wink_server_is_ready.patch patch applied
  - php-litespeed69-max_idle_timeout.patch patch applied


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 7.1.2-1.cloudlinux.1
changelog:
  - EA-5946: force requirement of ea-libtidy instead of .so from BuildRequires ea-libtidy-devel
  - EA-5839: Add opcache.validate_permission to opcache ini
  - EA-5807: enable php-tidy on rhel 6 and above


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.33-4.cloudlinux.2
changelog:
  - Fix bug #79099: OOB read in php_strip_tags_ex (CVE-2020-7059)
  - Fix bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar` (CVE-2020-7060)
  - Fix bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)
  - Fix bug #79091: heap use-after-free in session_create_id()
  - Fix bug #79221: Null Pointer Dereference in PHP Session Upload Progress (CVE-2020-7062)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-6.cloudlinux.1
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #75673: SplStack::unserialize() behavior
  - Fix bug #79199: curl_copy_handle() memory leak
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79393: Null coalescing operator failing with SplFixedArray
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79413: session_create_id() fails for active sessions
  - Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)
  - Fix bug #79468: SIGSEGV when closing stream handle with a stream filter appended


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-7.cloudlinux.2
changelog:
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79797: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79783: Segfault in php_str_replace_common
  - Fix bug #79877: getimagesize function silently truncates after a null byte
  - Fix bug #62890: default_socket_timeout=-1 causes connection to timeout


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-7.cloudlinux.4
changelog:
  - Fix bug #79601: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)
  - Fix bug #79825: opcache.file_cache causes SIGSEGV when custom opcode handlers changed
  - Fix bug #79986: str_ireplace bug with diacritics characters
  - Fix bug #80007: Potential type confusion in unixtojd() parameter parsing
  - Fix bug #80049: Memleak when coercing integers to string via variadic argument


author: <dan@cpanel.net> - 7.2.0-3.RC1
changelog:
  - EA-6757: Update 7.2.0 from beta3 to RC1
  - fix version specific symlinks
  - remove TZ patch for now (EA-6764 may re-add a version of it)
  - Add patch to fix RC1 bug  https://bugs.php.net/bug.php?id=75149 until the next version


author: Daniil Leonov <dleonov@cloudlinux.com> - 7.2.34-3.cloudlinux.2
changelog:
  - Fix Bug #73809: Phar Zip parse crash - mmap fail
  - Fix Bug #77322: PharData::addEmptyDir('/') Possible integer overflow
  - Fix Bug #77423: FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  - Fix Bug #77961: Slow reqursive functions with MySQL
  - Fix Bug #80366: Potential issue in ext/standard/iptc.c: Return Value Not Checked
  - Fix Bug #80411: References to null-serialized object break serialize()


author: Cory McIntire <cory@cpanel.net> - 7.3.3-1
changelog:
  - Updated to version 7.3.3 via update_pkg.pl (EA-8275)
  - Added patch for phpize to handle autotools on C6


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.3.5-2.cloudlinux.1
changelog:
  - Apply mod_lsapi_mode patch
  - Update userini_homedir.patch, log.patch, use_reject.patch to latest versions


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-4.cloudlinux.1
changelog:
  - ELS-189: Fix for Harden PHP
  - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
  - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-4.cloudlinux.2
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-4.cloudlinux.3
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-5.cloudlinux.1
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-5.cloudlinux.2
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-5.cloudlinux.3
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-10.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-10.cloudlinux.2
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.4
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.7
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-8.cloudlinux.1
changelog:
  - CVE-2022-4900: Prevent potential buffer overflow for php_cli_server_workers_max
  - EA4D-470: build intl with system icu for RHEL >= 9


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-9.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-12.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.4.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Cory McIntire <cory.mcintire@webpros.com> - 7.4.33-15
changelog:
  - ZC-12614: Rolling “ea-php74” back to “2ae8a0c01d69dbc710734ff516c17a19a479fa13”: was not meant to be merged


author: Rishwanth Yeddula <rish@cpanel.net> - 5.1.8-2
changelog:
  - SEC-312: Stop reading the 'REVISION' file. This addresses an
    arbitrary file read vulnerability in passenger.


author: Daniel Muey <dan@cpanel.net> - 5.3.5-3
changelog:
  - ZC-4661: Make nodejs a requirement so that if they get one they get all of them, that way Application Manager has all the bells


author: Daniel Muey <dan@cpanel.net> - 6.0.7-2
changelog:
  - ZC-7655: Provide/Conflict `apache24-passenger`
  - ZC-7897: Add version/package specific template file (and support userdata paths like nginx)


