End of life since 30 November 2020
CentOS 6 end of life
CentOS 6 reached end of life on 30 November 2020. The CentOS Project publishes no more updates. Its packages stay at the versions below: the kernel, OpenSSH, OpenSSL, glibc, sudo and the rest. We backport security fixes to them, so the server keeps running while you plan the move.
- 17exploited vulnerabilities in its components
- 161critical
- 71months past end of life
What CentOS 6 still runs
| Component | Version | Package | Known CVEs |
|---|---|---|---|
| Linux kernel | 2.6.32 | 2.6.32-754.el6 | 3,883 |
| glibc | 2.12 | 2.12-1.212.el6_10.3 | |
| OpenSSL | 1.0.1e | 1.0.1e-58.el6_10 | 77 |
| OpenSSH | 5.3p1 | 5.3p1-124.el6_10 | 60 |
| sudo | 1.8.6p3 | 1.8.6p3-29.el6_10.3 | |
| bash | 4.1.2 | 4.1.2-48.el6 | |
| curl | 7.19.7 | 7.19.7-54.el6_10 | |
| polkit | 0.96 | 0.96-11.el6_10.1 | |
| PHP | 5.3.3 | 5.3.3-50.el6_10 | 266 |
| Python 2 | 2.6.6 | 2.6.6-68.el6_10 | |
| Apache httpd | 2.2.15 | 2.2.15-69.el6.centos | |
| MySQL | 5.1.73 | 5.1.73-8.el6_8 | |
| PostgreSQL | 8.4.20 | 8.4.20-8.el6_9 | |
| OpenJDK | 1.8.0.275.b01 | 1.8.0.275.b01-0.el6_10 |
Latest versions in the distribution's public repositories, 28 October 2026. Known CVEs: for the upstream version, from the US National Vulnerability Database. Distribution packages include fixes backported before end of life, so not every one of them applies; your assessment shows which risks are real.
Exploited vulnerabilities in CentOS 6's components
Vulnerabilities in the upstream versions of CentOS 6's kernel, OpenSSH, OpenSSL and PHP that are listed in the CISA catalogue of known exploited vulnerabilities, highest score first. CentOS 6 packages may include fixes made before end of life.
| CVE | Component | Score | Severity | Published | Description |
|---|---|---|---|---|---|
| CVE-2012-1823 Exploited | PHP | 9.8 | Critical | 2012-05-11 | sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. |
| CVE-2013-6282 Exploited | Linux kernel | 8.8 | High | 2013-11-20 | The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013. |
| CVE-2013-2094 Exploited | Linux kernel | 8.4 | High | 2013-05-14 | The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call. |
| CVE-2021-22555 Exploited | Linux kernel | 8.3 | High | 2021-07-07 | A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space |
| CVE-2010-3904 Exploited | Linux kernel | 7.8 | High | 2010-12-06 | The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls. |
| CVE-2013-2596 Exploited | Linux kernel | 7.8 | High | 2013-04-13 | Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program. |
| CVE-2014-3153 Exploited | Linux kernel | 7.8 | High | 2014-06-07 | The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. |
| CVE-2017-1000253 Exploited | Linux kernel | 7.8 | High | 2017-10-05 | Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary. |
| CVE-2018-14634 Exploited | Linux kernel | 7.8 | High | 2018-09-25 | An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable. |
| CVE-2022-0492 Exploited | Linux kernel | 7.8 | High | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. |
| CVE-2024-53104 Exploited | Linux kernel | 7.8 | High | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming. |
| CVE-2024-53197 Exploited | Linux kernel | 7.8 | High | 2024-12-27 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration. |
| CVE-2014-0160 Exploited | OpenSSL | 7.5 | High | 2014-04-07 | The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. |
| CVE-2024-53150 Exploited | Linux kernel | 7.1 | High | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. |
| CVE-2016-5195 Exploited | Linux kernel | 7.0 | High | 2016-11-10 | Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW." |
| CVE-2021-0920 Exploited | Linux kernel | 6.4 | Medium | 2021-12-15 | In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel |
| CVE-2014-0196 Exploited | Linux kernel | 5.5 | Medium | 2014-05-07 | The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. |
What you can do
Keep CentOS 6, patched
We backport the security fixes to the CentOS 6 packages you run: the kernel, OpenSSH, OpenSSL, glibc and the rest, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to AlmaLinux, Rocky Linux or RHEL 9, once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.