com php-src: Merge branch 'bug68710' into PHP-5.4: NEWS
| From: | Stanislav Malyshev | Date: | Tue, 20 Jan 2015 09:02:26 +0000 |
| Subject: | com php-src: Merge branch 'bug68710' into PHP-5.4: NEWS | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-84210@lists.php.net to get a copy of this message | ||
Commit: e63f7b47e1937821e75e9862284c3150e1b1d524
Author: Stanislav Malyshev <stas@php.net> Tue, 20 Jan 2015 01:00:52 -0800
Parents: fc6aa939f59c9be0febe0fa141629e49541bab8c b585a3aed7880a5fa5c18e2b838fc96f40e075bd
Branches: PHP-5.4
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=e63f7b47e1937821e75e9862284c3150e1b1d524
Log:
Merge branch 'bug68710' into PHP-5.4
* bug68710:
Fix for bug #68710 (Use After Free Vulnerability in PHP's unserialize())
Bugs:
https://bugs.php.net/68710
Changed paths:
MM NEWS
Diff:
diff --cc NEWS
index 43e4c1e,f789a92..e4629f9
--- a/NEWS
+++ b/NEWS
@@@ -1,21 -1,12 +1,25 @@@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? 20?? PHP 5.4.37
+ - Core:
- . Fix bug #68710 (Use after free vulnerability in unserialize(), incomplete
- fix for #68594). (Stefan Esser)
++ . Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize()).
++ (CVE-2015-0231) (Stefan Esser)
+
- CGI:
- . Fix bug #68618 (out of bounds read crashes php-cgi). (Stas)
+ . Fixed bug #68618 (out of bounds read crashes php-cgi). (Stas)
+
+- EXIF:
+ . Fix bug #68799: Free called on unitialized pointer. (CVE-2015-0232) (Stas)
+
+- Fileinfo:
+ . Removed readelf.c and related code from libmagic sources
+ (Remi, Anatol)
+ . Fixed bug #68735 (fileinfo out-of-bounds memory access).
+ (Anatol)
+
+- OpenSSL:
+ . Fixed bug #55618 (use case-insensitive cert name matching).
+ (Daniel Lowrey)
18 Dec 2014 PHP 5.4.36