<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="138">
<package pkgid="788251aae3c1e5ea705ca52da827c75924202db7013ae765f50612a8e22d79a4" name="php55" arch="x86_64">
  <version epoch="0" ver="1.1" rel="7.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1" date="1375444800">- initial packaging</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1.5" date="1379419200">- add macros.php55-build for scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-1" date="1384862400">- build for RHSCL 1.1</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-2" date="1384862401">- fix scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-4" date="1390219200">- rebuild with latest scl-utils #1054731</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-5" date="1392206400">- avoid empty debuginfo subpackage
- add LICENSE, README and php55.7 man page #1061455
- add scldevel subpackage #1063357</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-6" date="1395662400">- own locale and man directories, #1074337</changelog>
  <changelog author="Honza Horak &lt;hhorak@redhat.com&gt; - 1.1-7" date="1396267200">- Fix path typo in README
  Related: #1061455</changelog>
</package>
<package pkgid="4c6fc9d43dca9a2665e6cb436840be27037df341913ef8b760ced22ac7ce7da8" name="php55" arch="x86_64">
  <version epoch="0" ver="2.0" rel="1.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1" date="1375444800">- initial packaging</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1.5" date="1379419200">- add macros.php55-build for scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-1" date="1384862400">- build for RHSCL 1.1</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-2" date="1384862401">- fix scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-4" date="1390219200">- rebuild with latest scl-utils #1054731</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-5" date="1392206400">- avoid empty debuginfo subpackage
- add LICENSE, README and php55.7 man page #1061455
- add scldevel subpackage #1063357</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-6" date="1395662400">- own locale and man directories, #1074337</changelog>
  <changelog author="Honza Horak &lt;hhorak@redhat.com&gt; - 1.1-7" date="1396267200">- Fix path typo in README
  Related: #1061455</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 2.0-1" date="1426593600">- fix incorrect selinux contexts #1194336</changelog>
</package>
<package pkgid="1d7372e8c83f2ee0262c20454f9c347c240aea1a04ee9c4964bd096731862931" name="php55-build" arch="x86_64">
  <version epoch="0" ver="1.1" rel="7.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1" date="1375444800">- initial packaging</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1.5" date="1379419200">- add macros.php55-build for scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-1" date="1384862400">- build for RHSCL 1.1</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-2" date="1384862401">- fix scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-4" date="1390219200">- rebuild with latest scl-utils #1054731</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-5" date="1392206400">- avoid empty debuginfo subpackage
- add LICENSE, README and php55.7 man page #1061455
- add scldevel subpackage #1063357</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-6" date="1395662400">- own locale and man directories, #1074337</changelog>
  <changelog author="Honza Horak &lt;hhorak@redhat.com&gt; - 1.1-7" date="1396267200">- Fix path typo in README
  Related: #1061455</changelog>
</package>
<package pkgid="9646962c964b6cc6f905f31b2c5ce3ec16056d9bb6214bd91210304719c4bece" name="php55-build" arch="x86_64">
  <version epoch="0" ver="2.0" rel="1.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1" date="1375444800">- initial packaging</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1.5" date="1379419200">- add macros.php55-build for scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-1" date="1384862400">- build for RHSCL 1.1</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-2" date="1384862401">- fix scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-4" date="1390219200">- rebuild with latest scl-utils #1054731</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-5" date="1392206400">- avoid empty debuginfo subpackage
- add LICENSE, README and php55.7 man page #1061455
- add scldevel subpackage #1063357</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-6" date="1395662400">- own locale and man directories, #1074337</changelog>
  <changelog author="Honza Horak &lt;hhorak@redhat.com&gt; - 1.1-7" date="1396267200">- Fix path typo in README
  Related: #1061455</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 2.0-1" date="1426593600">- fix incorrect selinux contexts #1194336</changelog>
</package>
<package pkgid="fc2c30927587f22d774b67180ccadbbd5f09830c330bbe5a2b27c09179f595ab" name="php55-php" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="6e09925f72b881adec030f9c391dc20ac10f07588c7515a1c9867e6f51653173" name="php55-php" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="0a26ca448752318ca0bb682a499884fe138213ec1b44cc70d02ca13a9074c73f" name="php55-php" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="2b9185a084ab6238ec5343f33b8c1386b850af52926c4fa11df03c09b5a634e5" name="php55-php" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="2656202920e3719df711f3744a6c888b7482f950bb1536ed3f0137c70ae616ab" name="php55-php" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="238951b455069015f3ecbd446e025af292e3004548b808940f26579d7e6b8f70" name="php55-php-bcmath" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="0ea19130824be4ffe600d676b0cd581366fab8867ac5d4b32eafcba77c958fc3" name="php55-php-bcmath" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="036ef1b08ffbf8dcd575e1cf7476746893c423b628e3621b0e26209512726de8" name="php55-php-bcmath" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="845a7493bd15e0a2018ad6c8d276b352dd446377148520b703e184e27bafc2e5" name="php55-php-bcmath" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="e673eceb46c0a1246c32bbe248588a8ce3c437fc4f930ddc661638d6d8862a3d" name="php55-php-bcmath" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="ab9c8e8aad72d37369fb74cd9c4c7df45e65999fd0b8600fd4fa83556f9c7955" name="php55-php-cli" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="13fc5d990c9a3151749fa5c8e4e85ce8f1bba4dffdcf4d9866ee3a18b74badf1" name="php55-php-cli" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="0883e4a22c305def9121f3578f748df824d7c571370b388bb93b7904207f6ac1" name="php55-php-cli" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="c7107be5d527f109fcf76051dbaf4465e217d416b7ce4cb29eabfa8c3e6ae0a1" name="php55-php-cli" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="a3fd19e305c8203f405a8508fbbd2098adac2c1fa0261153ff143996b68bb425" name="php55-php-cli" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="40bbf7a2d35c715a325595efb8a09e6344d0059dcd8bbdb1633a488f763da9e4" name="php55-php-common" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="8e28393baae4dcd4e3dc56b3908546f7470d1cca47a53bc20e51e64afa42b95c" name="php55-php-common" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="13a9fcd3d32235b1e59c8af40f2cefc9422a64869677949b7f24bfa83dee005c" name="php55-php-common" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="c714abd87ddd910fb7a26f31bab52bb0cc2095ef5e5e42c23dfefdf97046edbd" name="php55-php-common" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="5292ddc8a6dfe0e13781a53bdc2b3417878f54b9bb7ef48567d263be4a21fc6e" name="php55-php-common" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="34ee24bc8da10fc2d8c07b6a6bc8cd364400d43febf5e6f3b15bd0ab80456607" name="php55-php-dba" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="cb514783c04e3f1c09f64b8ea8b5645409f91ee49f450049b92c916caaf33cb6" name="php55-php-dba" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="e08b21f08fa23a0dc3ca14f310247a66bf7a8f6419da8dd99f6b5f70e44766bd" name="php55-php-dba" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="74c27cb487a7b79f3cb9999eb3fcbf89a26c8b7e864505e1c91064432032c58c" name="php55-php-dba" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="350bc7fe617b9e09100944ce3c89c42827f0bbbff5229b16d5cadd7f00ff7ddb" name="php55-php-dba" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="558de1e15b1db88d411bb7445f3237278140beeb6b1256d3fc3e470909589238" name="php55-php-devel" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="c82441a69af0201f85b881a8103bf5cba76dec8c7d8263751135cfc2e5adc879" name="php55-php-devel" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="b654d62d2392bb084d59cdbd5941773ebfef10c4eb74c02858da798775fcc11c" name="php55-php-devel" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="6274aec2a014ea839f5e35b2636632dcc552add523971a0bfacfaad419ab837c" name="php55-php-devel" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="02c0fbfa5a60d2b520dfc507d98118934130753148b402fd237a18897b66a9a6" name="php55-php-devel" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="710ef6ee2c94391e28215610bd221cba38b45a95777ec6e6cd0b6401cb67270e" name="php55-php-enchant" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="fe949d136351b619c53d7c547f61ecf51824265b5454050cd441b742dd64d926" name="php55-php-enchant" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="e32d900aa5560a88fd27c60ca7adbe48f2a144bb72f1894b38012f313c8dda3b" name="php55-php-enchant" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="06961b9650d14395a8a9c6ab22f24ae97c63d7900c44c5cf0bbbc790a9c8eae2" name="php55-php-enchant" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="71e986d986712785473efc0d5947aa3058932cbab5cdea48cb59c92708f3dce8" name="php55-php-enchant" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="77aef53479a3ab29ba4e9d750ae8139a13e1dbf42f1f8e421ca2d44c8a5f91c0" name="php55-php-fpm" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="aca14a5821c40d08d229af3a5d772f0017ab52615e569589faa50e00a601f92f" name="php55-php-fpm" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="c3d2539bd6264f58ba23851cdca882660db2b9eb72dc92c187568f844b6f816b" name="php55-php-fpm" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="7880f9bd8f4df711f0f9b7073f3bc9489ebd6a80834d57864d23d372bb1c9211" name="php55-php-fpm" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="1479f57c0b568d89bf06f3edde133ed32800907be2d606b27d7c1e083de82ae4" name="php55-php-fpm" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="90bb016dbded2f3a73923e1d78b9a384d776ced09cacd32eee97ebde5c267b91" name="php55-php-gd" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="e194888096842623b1923152d5b9d81d332461b2f90a0d411e1a0fa21f4ae1db" name="php55-php-gd" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="03d2394705ec988a98f27f21bffe38174b621e8f71e9fab0783f9a676c064545" name="php55-php-gd" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="bab8f9000619517e4c1ca0d07ae693888d7a6ce179df65622b7b0cb53040dd43" name="php55-php-gd" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="20f262c0abc50e3c897c337b3d313c444449ded20481dacc03c42fd53ec2d6a9" name="php55-php-gd" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="f8df54d26280e18627e8c27b5bd3f8173296613d12ec0a064ab8857f6621d3a9" name="php55-php-gmp" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="797c1d92d6041da9bb8be5a3f928e197c3f89bea30d0fee2e47f12e948988bf6" name="php55-php-gmp" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="e6096dfb3bd935475c62c231afa613c09b5c0ab6e6227c0b40adc4c4fefd6e92" name="php55-php-gmp" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="30599d976bac1312db2fe8d11b9fee84f899a4519bbe4e520c89fdff504326fa" name="php55-php-gmp" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="0ac8ebdd2ae798e0285fd468d82a6800d237378aa5a03a312f35681629d69c7c" name="php55-php-gmp" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="75d82a1b59bf6c753482ac21922c6edb131953754e7066aa92345536dc2f3582" name="php55-php-intl" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="d2e49e31a82b36a35e6c5417707d2ef02cc26624a91144958c291a4fbdf0c2be" name="php55-php-intl" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="0216db85cd083aba2843b89d316df88ae5fdc8387c4a99c4ee4cd6227ca9578a" name="php55-php-intl" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="c9b019e677255184f7a43b27d34d49ac814406cdcbb16c7c9cebd61f93cbf8f8" name="php55-php-intl" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="c7e78bd572d3c2d76e13e2bb106bea3d69ed58232135644e420d7d8108d3dc7f" name="php55-php-intl" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="59b679763624cafeb13c6105f174aa9710b8a913c82967ae94df2e570ee14a3d" name="php55-php-ldap" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="e0eb13d5bda0da3f7d0a34c7b271f2c66d5b9d451923ad20190694f464a8230a" name="php55-php-ldap" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="d0d6f4b487d08c4c90229f43eb3300d610c10733ef54ab2fccef2f4743ce4827" name="php55-php-ldap" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="d7eb94a72f7b580b7ff1e34687b9c302a03d53874e12f35b09221a2820de7112" name="php55-php-ldap" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="77cd0ea9392d64db57bba1dfbd73bbfde766fdf34ed2ce73117c5e739c3b281f" name="php55-php-ldap" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="951fa1637e9d6c72e049db34ed35922420c33f9b3ad3c5ae25055cfaef59c4d4" name="php55-php-mbstring" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="c336ce77c8849abc5ebe8b6522085e2e60aae9655812b752e6b56173b6b80e5a" name="php55-php-mbstring" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="9238da9005ea08e48efae6c53954ff31e60d03842a1a6a433b73e680fd0a85e4" name="php55-php-mbstring" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="15b6d5ecfea6da137c767391b7d59f22053b968ee15eecd554a118ca407dce35" name="php55-php-mbstring" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="2c8634ee7cea0154315cc797ee8f42455ac5e437f1c785582a569d32f61a56e9" name="php55-php-mbstring" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="e6de479860639349145a83da1fb4c1d5ced7703e25fc36ee3245780be453bb99" name="php55-php-mysqlnd" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="260878e4951ba65d5d0a82181bd167d9fd0219dfa8bb50bf9b3692a17b052f28" name="php55-php-mysqlnd" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="f9655783f25a0f3748c192488e4502923ad2a2bcd1adb302d9653759d0a3db8e" name="php55-php-mysqlnd" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="b716c33258cc01982959e15cb52df4fe302ffbea4e0847ed14471cad8c2ea3f5" name="php55-php-mysqlnd" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="85a71f7776293df9a368b01699b4292f0428641fa9377e123f788ccbb74d4518" name="php55-php-mysqlnd" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="1565e0a7b5095d777b821af41bf109af7cf06cb03925c8df477f8a38b76e931d" name="php55-php-odbc" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="9323e1de4bfd7e16b543921e640b83b1c60f53df6dc7b85b3787998ce57ab99a" name="php55-php-odbc" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="8f2a819910015f2ae9415b943f2cf4b7e2812f3a12482bb22a34142e6fda282a" name="php55-php-odbc" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="8fc6ae495ff24dbff0ffe7e943a14261eae4f8ec13f48cc9caeca081819aa5c6" name="php55-php-odbc" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="2bf503ff3806a3d486ffd12410aca3fef12a08bc66f80afbf62c550a49bc9f8b" name="php55-php-odbc" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="ee00f20b815c9a70c056d3d317abb0f4e10f7359f992a1dccebb142bde79b669" name="php55-php-opcache" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="568bddb3d08d9b61e732bf088afbf2983325aa4c036fa54243e05c255f135945" name="php55-php-opcache" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="1e10f88e479a64f345c67bb02cbb1f79102d8294af0db4dd65bb9850464410a2" name="php55-php-opcache" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="4cb8869031431b5071cb46a9a37fb5ce669142f68cbe712daea32a7647209198" name="php55-php-opcache" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="ae1b9ceea35cafec4ef13756b9e2f942bdd0272fee7532bcf6f2d77d6ea6de35" name="php55-php-opcache" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="79d6f16f51823b3b72d86f838ca560cdcb47f0e44672513528e54a0bd6503672" name="php55-php-pdo" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="6128299d54bb1267f5a185c08665e4aae5758d9bc4a75f51d71bcf79cd19386b" name="php55-php-pdo" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="15fb53c45f3c072fca10e09819f7d00761314f43ee2f9415ccecac08b037c4b5" name="php55-php-pdo" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="5645df850a54b845df1b27af8c76c53b16d2809813372c0d7dc71c953da06b1d" name="php55-php-pdo" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="2877ec5b5e508d4825ccebf811dfb88df009eb83e811c8e697735f4527ee19a7" name="php55-php-pdo" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="87f21e9dcd1a4e81fff52b0552a51541e8cf3c883d7d9c86fc5190330eb41213" name="php55-php-pear" arch="noarch">
  <version epoch="1" ver="1.9.4" rel="10.el7"/>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; 1:1.9.4-11" date="1345377600">- move data to /usr/share/pear-data
- provides all package.xml</changelog>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; 1:1.9.4-12" date="1348660800">- drop relocate stuff, no more needed</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1:1.9.4-1" date="1349265600">- initial spec rewrite for scl build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1:1.9.4-2" date="1349265601">- rename, but don't relocate macros.pear</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1:1.9.4-3" date="1350993600">- provides pear command in standard root (scl)</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1:1.9.4-5" date="1366891200">- update Archive_Tar to 1.3.11
- add explicit requires on all needed extensions (phpci)
- fix pecl launcher (need ini to be parsed for some
  extensions going to be build as shared, mainly simplexml)
- move metadata to /var/lib/pear
- own %{_localstatedir}/www (#956529)
- update config only if needed in %post
- remove %config flag for macros.pear</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1:1.9.4-6" date="1367841600">- don't verify metadata file content (#959425)</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1:1.9.4-7" date="1369310400">- remove wrappers in /usr/bin (#966509)</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1:1.9.4-8" date="1380024000">- relocate RPM macro #1008846</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1:1.9.4-10" date="1391515200">- expand all macros #1058639</changelog>
</package>
<package pkgid="858b0776e18bcf1c363001cdae0c19e21f358f1c9ab920388e6be82b2525460b" name="php55-php-pecl-jsonc" arch="x86_64">
  <version epoch="0" ver="1.3.5" rel="1.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.0-0.1" date="1367064000">- initial package</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.0-0.2" date="1367064001">- rebuild with latest changes</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.0-0.3" date="1367236800">- rebuild with latest changes
- use system json-c library
- temporarily rename to jsonc-c.so</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.0-1" date="1370347200">- release 1.3.0 (beta)
- use system json-c when available (fedora &gt;= 20)
- use jsonc name for module and configuration</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.1-1" date="1371038400">- release 1.3.1 (beta)
- rename to php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.1-1" date="1375444800">- adapt for SCL, without ZTS</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.2-1" date="1378728000">- release 1.3.2 (stable)</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.2-2" date="1383652800">- fix decode of string value with null-byte
  https://github.com/remicollet/pecl-json-c/issues/7</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.3-1" date="1387195200">- release 1.3.3 (stable) #1042701</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.5-1" date="1397131200">- release 1.3.5 (stable) for CVE-2013-6371 CVE-2013-6370</changelog>
</package>
<package pkgid="23736481f8a8c7c374aebfda872d479da701b861d353e6432dfb27f2f8f1e35f" name="php55-php-pecl-jsonc-devel" arch="x86_64">
  <version epoch="0" ver="1.3.5" rel="1.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.0-0.1" date="1367064000">- initial package</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.0-0.2" date="1367064001">- rebuild with latest changes</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.0-0.3" date="1367236800">- rebuild with latest changes
- use system json-c library
- temporarily rename to jsonc-c.so</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.0-1" date="1370347200">- release 1.3.0 (beta)
- use system json-c when available (fedora &gt;= 20)
- use jsonc name for module and configuration</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.1-1" date="1371038400">- release 1.3.1 (beta)
- rename to php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.1-1" date="1375444800">- adapt for SCL, without ZTS</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.2-1" date="1378728000">- release 1.3.2 (stable)</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.2-2" date="1383652800">- fix decode of string value with null-byte
  https://github.com/remicollet/pecl-json-c/issues/7</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.3-1" date="1387195200">- release 1.3.3 (stable) #1042701</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.3.5-1" date="1397131200">- release 1.3.5 (stable) for CVE-2013-6371 CVE-2013-6370</changelog>
</package>
<package pkgid="d316bc4d636880760c365b062c2b4df7bb1eb6c336f760ce952cdff01a217185" name="php55-php-pecl-memcache" arch="x86_64">
  <version epoch="0" ver="3.0.8" rel="3.el7"/>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; - 3.0.7-1" date="1348401600">- update to 3.0.7
- drop patches merged upstream
- cleanup spec</changelog>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; - 3.0.7-2" date="1348401601">- use upstream patch instead of our (memleak)</changelog>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; - 3.0.7-3" date="1348574400">- switch back to previous patch as possible memleak
  more acceptable than certain segfault</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 3.0.7-1" date="1349265600">- initial spec rewrite for scl build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 3.0.7-1.1" date="1350993600">- fix RHEL-5 build (add buildroot + defattr)</changelog>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; - 3.0.7-4" date="1352980800">- improve comment in configuration about session.</changelog>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; - 3.0.7-5" date="1356782400">- add patch for https://bugs.php.net/59602
  segfault in getExtendedStats
- also provides php-memcache</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 3.0.8-1" date="1365595200">- Update to 3.0.8</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 3.0.8-2" date="1374148800">- rebuild for new value of php(zend-abi) and php(api) #985353</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 3.0.8-3" date="1379937600">- rebuild</changelog>
</package>
<package pkgid="2db32d0a763b9d567011ffdbf47636ab3fa5c1ae6ba9235f9c560468ee29702b" name="php55-php-pecl-mongo" arch="x86_64">
  <version epoch="0" ver="1.4.5" rel="1.el7"/>
  <changelog author="Remi Collet &lt;RPMS@FamilleCollet.com&gt; - 1.3.3-1" date="1358337600">- update to 1.3.3</changelog>
  <changelog author="Remi Collet &lt;RPMS@FamilleCollet.com&gt; - 1.3.4-1" date="1359633600">- update to 1.3.4</changelog>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; - 1.3.5-1" date="1363348800">- Update to 1.3.5</changelog>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; - 1.3.6-1" date="1364299200">- Update to 1.3.6</changelog>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; - 1.3.7-1" date="1365595200">- Update to 1.3.7</changelog>
  <changelog author="Remi Collet &lt;remi@fedoraproject.org&gt; - 1.4.0-1" date="1369137600">- Update to 1.4.0</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.4.2-1" date="1374580800">- update to 1.4.2
- adapt for SCL, without ZTS</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.4.2-1.1" date="1379419200">- rebuild</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.4.4-1" date="1380110400">- update to 1.4.4</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 1.4.5-1" date="1383652800">- update to 1.4.5</changelog>
</package>
<package pkgid="9eb986987cf2b1b3a41f6e1ab9ceeefc0b54b24fd64023676a548f4dc14cd10b" name="php55-php-pgsql" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="5152c05a7591895ebb5f937e501abaa8d3c3325e994c666586c22de8eeb9b172" name="php55-php-pgsql" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="87c5bc43f895a6ffee6808590bf265228f80e3e0941a9e797d45230b10db60e6" name="php55-php-pgsql" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="1c05d0a1680f502445481a580ffd45b89e034d5b7aa018d4e0735a818a4fb512" name="php55-php-pgsql" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="baef923623ca108e3c2f1f476265f5f90482595473343a5cd8242d4bb472dfab" name="php55-php-pgsql" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="7cf49c066639d963d035a31940c3592253a060d56237634072de1d247c8d84e1" name="php55-php-process" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="d3441637fc1a0ae644620c3c4c7331864c77bb9a0d3d4a39f0d2b3ceb472cf51" name="php55-php-process" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="cead3368aa2a529225c87abd28d564ed0b2c8ff82152c8dc1046f5a1d27a09e2" name="php55-php-process" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="907130e13f291e064518aa2568bfa82eac55c5a8ed4c0a4688c021533b112f63" name="php55-php-process" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="c67c4706cc2236a963560d8f45000cc15282691ad26e738e4561fca9442fb1b3" name="php55-php-process" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="db34ac7ca3efdb2627dc87b69361c7f80d99ea77690f4a5e98a4e5b8454349ad" name="php55-php-pspell" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="f4f96b7b994a66deb43c3190452de6ac9f097333b6972b0cc66b01e8d4f60f2d" name="php55-php-pspell" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="ba86ec3de66b6a72e69f713b23b658422b192cdc9c03c5964d82a2c6c413e581" name="php55-php-pspell" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="ae1899c875c74bc2dbe71db0a32404e4b69863ac6a5074455cdda9fd83e15ba9" name="php55-php-pspell" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="a5657fd6ce604544e00e8b34de0da2f74c79619ecf0914f70ea8559b3205d1a5" name="php55-php-pspell" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="f20fe32ce8cc91240e91fadac48bfed36dc4f5922ed668dda4599f4303ee1a0b" name="php55-php-recode" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="0c7ff21eea844454b091eae13a3ddba526d97c391de18726abd284579db21b7d" name="php55-php-recode" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="c49c1fadcbaec7a49481985bfbda33f22baa141837f1f1bf55982ce9d27de16c" name="php55-php-recode" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="b755996fe0a8d889f638ce0d25a8b17ccc44a9cb14ac1cd00e79cb6ed7b4787e" name="php55-php-recode" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="a5393e2a7a67d38f38fe3a6a4d49c994632b42a3d4e5e5e21dc7d6a602f78e86" name="php55-php-recode" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="bb64d34bea02c80a133805937d432306c4480fd3fbce10ce865eef5416789081" name="php55-php-snmp" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="10796ca9ac44e288a173e5be68f763575f0f7c318c835a22f2e450f6ff8e359c" name="php55-php-snmp" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="2a5b2bdd7dfdaee22f2bb08ead6d97bbca491a259a37349686bab7976f613e82" name="php55-php-snmp" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="d193beeece4ca926d8397dffa865ec1ba67434c87dd3a0170e7d924a23b5696e" name="php55-php-snmp" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="9772aafb56de3006f514b31232c0af7a451357f562d152efeab248ace616889a" name="php55-php-snmp" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="19076100343a1bf64fc4a891982f34d54d20c6790c470f65e6113a27e0f180ec" name="php55-php-soap" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="413ee06f6370ece2c3e072abafa9a819b65c4e321183b4818b8583435d0977b3" name="php55-php-soap" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="80b09babaa3de48a185a1c9fe4c6a41f4f9ccdf203e0e0be9bd7479c540f92f8" name="php55-php-soap" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="2114c0ad1a20f2474fbbdf357578a40d538c1e06afa4607c04132d8c44f3b008" name="php55-php-soap" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="f64ebdc34b49fda9f3bf4d6e0fad438b548f4444085fb3c9283724b018a65ad9" name="php55-php-soap" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="f80efde5dc79b441cb19258c366cbee20e157eeb5e85e287e8802af661bf6da8" name="php55-php-xml" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="895a17c158f4b09eb740fbb6733ccfb4c65efd8ef78b199b5722553efe24a582" name="php55-php-xml" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="558e85d728b6598b072d32436e22e746e5195147d132d30351ebafa2b5e726ed" name="php55-php-xml" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="72b3df2dfe94faeeaca75087e5f10850e3bcd74ccaf540aeb13ec279c496f572" name="php55-php-xml" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="7f8d1d9e0502adcdfcc1bfb193c9d3c2ae3fa48eadc478574603e7575d223b43" name="php55-php-xml" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="f3481336b8cfdcecf0704e94e92f7deb11f592cd01b81374ceb80e0f9733d572" name="php55-php-xmlrpc" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="2.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
</package>
<package pkgid="a1e468c62f5fbdc31da908f4c511f9cd782274b45b5747e5ab807fe4fd0b8149" name="php55-php-xmlrpc" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="4.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Scientific Linux Auto Patch Process &lt;SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV&gt;" date="1435233600">- Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
  by assuming the date is correct and changing the weekday.</changelog>
</package>
<package pkgid="be551f30d2f884dbae7f0929be0b10626a5006f7ffd0084be5e8ad54eaa9e4ee" name="php55-php-xmlrpc" arch="x86_64">
  <version epoch="0" ver="5.5.21" rel="5.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.20-1" date="1419336000">- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-1" date="1421928000">- rebase to PHP 5.5.21</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-2" date="1429012800">- core: fix use-after-free vulnerability in the
  process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
  move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
  with DateTimeZone CVE-2015-0273
- enchant: fix  heap buffer overflow in
  enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-3" date="1433851200">- core: fix multipart/form-data request can use excessive
  amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
  CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
  file #1213442
- ftp: fix integer overflow leading to heap overflow when
  reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
  CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
  empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
  interpreter under httpd 2.4 CVE-2015-3330</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-4" date="1433937600">- fix more functions accept paths with NUL character #1213407</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.21-5" date="1469188800">- don't set environmental variable based on user supplied Proxy
  request header CVE-2016-5385</changelog>
</package>
<package pkgid="7c0b9a0f01a09ac66055bec1caaeb8e7abe8c24b37c6b966f6d1bedeb6545853" name="php55-php-xmlrpc" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="10.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.5-1" date="1382011200">- update to PHP 5.5.5
- mod_php only for httpd24</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-0" date="1384862400">- update to PHP 5.5.6
- buildstrap build</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 5.5.6-2" date="1384862401">- rebuild with test enabled
- add dependency on php-pecl-jsonc</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
</package>
<package pkgid="6903b994d1319f2e0cc951b6d0483d4760a7affd6efe79942cb345444a15e81f" name="php55-php-xmlrpc" arch="x86_64">
  <version epoch="0" ver="5.5.6" rel="13.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-4" date="1386331200">- add security fix for CVE-2013-6420</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-5" date="1391515200">- allow multiple paths in ini_scan_dir #1058161</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-6" date="1392379200">- fix heap overflow vulnerability in imagecrop CVE-2013-7226</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-7" date="1392811200">- fix infinite recursion in fileinfo CVE-2014-1943</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-8" date="1392984000">- fix patch name
- fix memory leak introduce in patch for CVE-2014-1943
- fix heap-based buffer over-read in DateInterval CVE-2013-6712</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-9" date="1395403200">- gd: fix NULL deref in imagecrop CVE-2013-7327
- gd: drop vpx support, fix huge memory consumption #1075201</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-10" date="1399982400">- fileinfo: fix out-of-bounds memory access CVE-2014-2270
- fileinfo: fix extensive backtracking CVE-2013-7345</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-11" date="1412769600">- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
  CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- core: fix heap-based buffer overflow in DNS TXT record
  parsing. CVE-2014-4049
- network: fix segfault in dns_get_record
  (incomplete fix for CVE-2014-4049). CVE-2014-3597
- core: unserialize() SPL ArrayObject / SPLObjectStorage
  type confusion flaw. CVE-2014-3515
- core: type confusion issue in phpinfo(). CVE-2014-4721
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- fileinfo: cdf_unpack_summary_info() excessive looping
  DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
  loop. CVE-2014-0238
- fileinfo: cdf_read_short_sector insufficient boundary
  check. CVE-2014-0207
- fileinfo: fix extensive backtracking in regular expression
  (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: cdf_check_stream_offset insufficient boundary
  check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
  CVE-2014-3480
- fileinfo: fix mconvert incorrect handling of truncated
  pascal string size. CVE-2014-3478
- fileinfo: cdf_read_property_info insufficient boundary
  check. CVE-2014-3487
- fileinfo: fix cdf_read_property_info
  (incomplete fix for CVE-2012-1571). CVE-2014-3587</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 5.5.6-12" date="1413806400">- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670</changelog>
  <changelog author="Jan Kaluza &lt;jkaluza@redhat.com&gt; - 5.5.6-13" date="1414065600">- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710</changelog>
</package>
<package pkgid="5b55e5d407680a2044c264c938da89f12a269de12ff253695eedba88fe5c345a" name="php55-runtime" arch="x86_64">
  <version epoch="0" ver="1.1" rel="7.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1" date="1375444800">- initial packaging</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1.5" date="1379419200">- add macros.php55-build for scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-1" date="1384862400">- build for RHSCL 1.1</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-2" date="1384862401">- fix scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-4" date="1390219200">- rebuild with latest scl-utils #1054731</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-5" date="1392206400">- avoid empty debuginfo subpackage
- add LICENSE, README and php55.7 man page #1061455
- add scldevel subpackage #1063357</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-6" date="1395662400">- own locale and man directories, #1074337</changelog>
  <changelog author="Honza Horak &lt;hhorak@redhat.com&gt; - 1.1-7" date="1396267200">- Fix path typo in README
  Related: #1061455</changelog>
</package>
<package pkgid="c2e69207616c4e3235af9dd95301f655c8bd7fd7f4d7efc5a3ddad1ce68563a1" name="php55-runtime" arch="x86_64">
  <version epoch="0" ver="2.0" rel="1.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1" date="1375444800">- initial packaging</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1.5" date="1379419200">- add macros.php55-build for scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-1" date="1384862400">- build for RHSCL 1.1</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-2" date="1384862401">- fix scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-4" date="1390219200">- rebuild with latest scl-utils #1054731</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-5" date="1392206400">- avoid empty debuginfo subpackage
- add LICENSE, README and php55.7 man page #1061455
- add scldevel subpackage #1063357</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-6" date="1395662400">- own locale and man directories, #1074337</changelog>
  <changelog author="Honza Horak &lt;hhorak@redhat.com&gt; - 1.1-7" date="1396267200">- Fix path typo in README
  Related: #1061455</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 2.0-1" date="1426593600">- fix incorrect selinux contexts #1194336</changelog>
</package>
<package pkgid="4272a8cf8987da666a684e8a3e4ca815beda0e073fb20c2b4aa5e841e49aaece" name="php55-scldevel" arch="x86_64">
  <version epoch="0" ver="1.1" rel="7.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1" date="1375444800">- initial packaging</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1.5" date="1379419200">- add macros.php55-build for scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-1" date="1384862400">- build for RHSCL 1.1</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-2" date="1384862401">- fix scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-4" date="1390219200">- rebuild with latest scl-utils #1054731</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-5" date="1392206400">- avoid empty debuginfo subpackage
- add LICENSE, README and php55.7 man page #1061455
- add scldevel subpackage #1063357</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-6" date="1395662400">- own locale and man directories, #1074337</changelog>
  <changelog author="Honza Horak &lt;hhorak@redhat.com&gt; - 1.1-7" date="1396267200">- Fix path typo in README
  Related: #1061455</changelog>
</package>
<package pkgid="cb028d916b9e68b225dd8ac0933e240bedef2d0b924c5743267f3fb7a1a68fe7" name="php55-scldevel" arch="x86_64">
  <version epoch="0" ver="2.0" rel="1.el7"/>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1" date="1375444800">- initial packaging</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1-1.5" date="1379419200">- add macros.php55-build for scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-1" date="1384862400">- build for RHSCL 1.1</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-2" date="1384862401">- fix scl_package_override</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-4" date="1390219200">- rebuild with latest scl-utils #1054731</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-5" date="1392206400">- avoid empty debuginfo subpackage
- add LICENSE, README and php55.7 man page #1061455
- add scldevel subpackage #1063357</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; 1.1-6" date="1395662400">- own locale and man directories, #1074337</changelog>
  <changelog author="Honza Horak &lt;hhorak@redhat.com&gt; - 1.1-7" date="1396267200">- Fix path typo in README
  Related: #1061455</changelog>
  <changelog author="Remi Collet &lt;rcollet@redhat.com&gt; - 2.0-1" date="1426593600">- fix incorrect selinux contexts #1194336</changelog>
</package>
</otherdata>