Le 03/07/2011 10:28, Spike Turner a écrit :
--- On Sat, 2/7/11, John R. Dennisonjrd@gerdesas.com wrote:
That's not been supported in, literally, ages. You may want to consider a "yum update" once in a while.
And yes, that specific version has multiple known and exploitable security issues.
JohnI'm running it on an internal box not accessible from the internet. I do run a yum update and that seems to be the latest CentOS Plus version.
http://mirror.centos.org/centos/4/centosplus/i386/RPMS/
You can see that the kernels are updated but the php is not, so I don't see why you said I should consider "running a yum update once in a while".
Hi Spike,
I agree. Here is what I have on a CentOS 5.6 machine : ]# yum info php .... Available Packages Name : php Arch : x86_64 Version : 5.1.6 Release : 27.el5_5.3 Size : 2.3 M Repo : base
So 5.1.6 is the current package on CentOS, at least in base repo, I don't know for CentOSPlus, and your question is totally valid.
I am not using PHP, so I am not aware of the last vulnerabilities, but you should know that RedHat backports security fixes, and features, from further releases, so the version number is not that informative. See for example this rather old thread (2010) : http://forums.whirlpool.net.au/archive/1424743
Hopes that helps...
Alain