|
![]() [ View full size screenshot ] |
| Version | Date Released | Status | Release Notes |
| 5.4.3 | May 9, 2012 | New Release | · PHP 5.4.3 fixes a buffer overflow vulnerability in the apache_request_headers() (CVE-2012-2329). |
| 5.4.2 | May 7, 2012 | New Release | · There is a vulnerability in certain CGI-based setups (Apache+mod_php and nginx+php-fpm are not affected) that has gone unnoticed for at least 8 years. If you are using Apache mod_cgi to run PHP you may be vulnerable. To see if you are, just add ?-s to the end of any of your URLs. If you see your source code, you are vulnerable. If your site renders normally, you are not. · To fix this, update to PHP 5.3.12 or PHP 5.4.2. |
| 5.4.1 | Apr 27, 2012 | New Release | CLI Server: · Fixed bug #61461 (missing checks around malloc() calls). · Implemented #60850 (Built in web server does not set $_SERVER['SCRIPT_FILENAME'] when using router). Core: · Fixed crash in ZTS using same class in many threads. · Fixed bug #61374 (html_entity_decode tries to decode code points that don't exist in ISO-8859-1). · Fixed bug #61225 (Incorrect lexing of 0b00*+). · Fixed bug #61106 (Segfault when using header_register_callback). · Fixed bug #61052 (Missing error check in trait 'insteadof' clause). · Fixed bug #61011 (Crash when an exception is thrown by __autoload accessing a static property). · Fixed bug #60978 (exit code incorrect). · Fixed bug #60911 (Confusing error message when extending traits). · Fixed bug #60717 (Order of traits in use statement can cause a fatal error). · Fixed bug #60573 (type hinting with "self" keyword causes weird errors). · Fileinfo · Fix fileinfo test problems. |
| 5.4.0 | Mar 5, 2012 | New Release | · autoconf 2.59+ is now supported (and required) for generating the configure script with ./buildconf. Autoconf 2.60+ is desirable otherwise the configure help order may be incorrect. |
| 5.3.8 | Jan 5, 2012 | New Release | |
| 5.3.6 | Mar 18, 2011 | New Release | · Upgraded bundled Sqlite3 to version 3.7.4. (Ilia) · Upgraded bundled PCRE to version 8.11. (Ilia) |
| 5.3.5 | Jan 12, 2011 | New Release | · Fixed crash in zip extract method (possible CWE-170). · Paths with NULL in them (foo bar.txt) are now considered as invalid (CVE-2006-7243). · Fixed a possible double free in imap extension (Identified by Mateusz Kocielski). (CVE-2010-4150). · Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709). · Fixed possible flaw in open_basedir (CVE-2010-3436). · Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950). · Fixed symbolic resolution support when the target is a DFS share. · Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data) (CVE-2010-3710). |
| 5.3.4 | Dec 13, 2010 | New Release | Security Enhancements and Fixes: · Fixed crash in zip extract method (possible CWE-170). · Paths with NULL in them (foo bar.txt) are now considered as invalid (CVE-2006-7243). · Fixed a possible double free in imap extension (Identified by Mateusz Kocielski). (CVE-2010-4150). · Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709). · Fixed possible flaw in open_basedir (CVE-2010-3436). · Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950). · Fixed symbolic resolution support when the target is a DFS share. · Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data) (CVE-2010-3710). Key Bug Fixes: · Added stat support for zip stream. · Added follow_location (enabled by default) option for the http stream support. · Added a 3rd parameter to get_html_translation_table. It now takes a charset hint, like htmlentities et al. · Implemented FR #52348, added new constant ZEND_MULTIBYTE to detect zend multibyte at runtime. |
| 5.3.3 | Aug 10, 2010 | New Release | This release focuses on improving the stability and security of the PHP 5.3.x branch with over 100 bug fixes, some of which are security related. All users are encouraged to upgrade to this release. |