Hi
It seems the fix for CVE-2019-9636 has slipped through the cracks as the SRPM has not been rebuilt and made available for CentOS 6.
https://access.redhat.com/security/cve/cve-2019-9636 https://access.redhat.com/errata/RHSA-2019:1467
Kind Regards, Andrew