PHP PHP 5.5.38 is released

eva2000 · Jul 23, 2016

The PHP development team announces the immediate availability of PHP 5.5.38.
Several security related issues were fixed in this release. All
PHP 5.5 users are encouraged to upgrade to this version.

Note that this should be the last PHP-5.5 release, which now reaches
its end of life. All PHP 5.5 users are encouraged to start a migration
to PHP 5.6 or PHP 7.0

For source downloads of PHP 5.5.38 please visit our downloads page:
PHP: Downloads

Windows binaries can be found on PHP For Windows: Binaries and sources Releases.

The list of changes is recorded in the ChangeLog:
PHP: PHP 5 ChangeLog
Click to expand...

21 Jul 2016

Core:

Fixed bug #71936 (Segmentation fault destroying HTTP_RAW_POST_DATA).

Fixed bug #72496 (Cannot declare public method with signature incompatible with parent private method).

Fixed bug #72138 (Integer Overflow in Length of String-typed ZVAL).

Fixed bug #72513 (Stack-based buffer overflow vulnerability in virtual_file_ex).

Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session Deserialization).

Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).

bz2:

Fixed bug #72447 (Type Confusion in php_bz2_filter_create()). (gogil at stealien dot com).

Fixed bug #72613 (Inadequate error handling in bzread()).

EXIF:

Fixed bug #50845 (exif_read_data() returns corrupted exif headers).

Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).

Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).

GD:

Fixed bug #43475 (Thick styled lines have scrambled patterns).

Fixed bug #53640 (XBM images require width to be multiple of 8).

Fixed bug #64641 (imagefilledpolygon doesn't draw horizontal line).

Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).

Fixed bug #72519 (imagegif/output out-of-bounds access).

Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).

Intl:

Fixed bug #72533 (locale_accept_from_http out-of-bounds access).

ODBC:

Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)

OpenSSL:

Fixed bug #71915 (openssl_random_pseudo_bytes is not fork-safe).

Fixed bug #72336 (openssl_pkey_new does not fail for invalid DSA params).

SNMP:

Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).

SPL:

Fixed bug #55701 (GlobIterator throws LogicException).

SQLite3:

Fixed bug #70628 (Clearing bindings on an SQLite3 statement doesn't work).

Streams:

Fixed bug #72439 (Stream socket with remote address leads to a segmentation fault).

Xmlrpc:

Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).

Zip:

Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).

Click to expand...

Continue reading...

eva2000 · Jul 23, 2016

For folks curious of specific HTTPoxy fix commits Fix for HTTP_PROXY issue. · php/php-src@98b9dfa · GitHub

Fix for HTTP_PROXY issue.

The following changes are made:
- _SERVER/_ENV only has HTTP_PROXY if the local environment has it,
and only one from the environment.
- getenv('HTTP_PROXY') only returns one from the local environment
- getenv has optional second parameter, telling it to only consider
local environment
Click to expand...

Log in / Register

Forums

Want to subscribe to topics you're interested in?

PHP PHP 5.5.38 is released

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

PHP PHP 5.5.38 is released

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.