Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand that RedHat backport CVE fixes to Apache and PHP for CentOS as updates where the version number doesn't necessarily increase, and that I can get these fixes with yum update php etc, so whilst looking at the version number it may appear to be vulnerable to CVE xyz but it could actually have the fixes. Please correct me if this is wrong.

How can I verify which CVE numbers are patched in my current PHP and Apache on a CentOS box?

share|improve this question
up vote 5 down vote accepted

You can look at the changelog to see what the packagers say they did:

$ rpm -q --changelog httpd
* Sun Feb 12 2012 Johnny Hughes <> - 2.2.15-15.1.el6.centos
- Roll in CentOS Branding

* Mon Feb 06 2012 Joe Orton <> - 2.2.15-15.1
- add security fixes for CVE-2011-4317, CVE-2012-0053, CVE-2012-0031,
  CVE-2011-3607 (#787598)
- obviates fix for CVE-2011-3638, patch removed

and so on.

I suppose you can trust the packager to do what they said they did.

If not, you can grab the source RPM, unpack it, and look at the set of patches being applied to the source tarball as it builds.

share|improve this answer
thanks for the quick reply - works for me. Am I correct about the backporting? Will accept your answer... – ServerBloke Mar 29 '12 at 18:50
@John Yes, you're correct about the backporting. RHEL doesn't really change the version number of the packages for a release, as the primary goal is long term stability. – cjc Mar 29 '12 at 19:21
@John SLES does the same. – Nils Mar 29 '12 at 20:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.