cvs: phpweb / ChangeLog-4.php ChangeLog-5.php index.php /include version.inc /releases 4_4_7.php 5_2_2.php index.php
| From: | Ilia Alshanetsky | Date: | Thu, 03 May 2007 23:31:50 +0000 |
| Subject: | cvs: phpweb / ChangeLog-4.php ChangeLog-5.php index.php /include version.inc /releases 4_4_7.php 5_2_2.php index.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-35298@lists.php.net to get a copy of this message | ||
iliaa Thu May 3 23:31:50 2007 UTC
Added files:
/phpweb/releases 4_4_7.php 5_2_2.php
Modified files:
/phpweb ChangeLog-4.php ChangeLog-5.php index.php
/phpweb/include version.inc
/phpweb/releases index.php
Log:
5.2.2 and 4.4.7 release news
http://cvs.php.net/viewvc.cgi/phpweb/ChangeLog-4.php?r1=1.69&r2=1.70&diff_format=u Index: phpweb/ChangeLog-4.php diff -u phpweb/ChangeLog-4.php:1.69 phpweb/ChangeLog-4.php:1.70 --- phpweb/ChangeLog-4.php:1.69 Thu Mar 1 08:48:16 2007 +++ phpweb/ChangeLog-4.php Thu May 3 23:31:49 2007 @@ -1,5 +1,5 @@ <?php -// $Id: ChangeLog-4.php,v 1.69 2007/03/01 08:48:16 derick Exp $ +// $Id: ChangeLog-4.php,v 1.70 2007/05/03 23:31:49 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'ChangeLog-4.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4 ChangeLog"); @@ -11,6 +11,31 @@ <hr/> +<a name="4.4.7"></a> +<h3>Version 4.4.7</h3> +<b>03-May-2007</b> +<ul> +<li>Fixed MOPB-33-2007 (PHP mail() Message ASCIIZ Byte Truncation).</li> +<li>Fixed MOPB-32-2007 (Double free inside session_decode()).</li> +<li>Fixed MOPB-26-2007 (mb_parse_str() can be used to activate register_globals).</li> +<li>Fixed MOPB-24-2007 (Fixed unallocated memory access/double free in in array_user_key_compare()).</li> +<li>Fixed MOPB-22-2007 (PHP session_regenerate_id() Double Free Vulnerability).</li> +<li>Fixed MOPB-21-2007 (An open_basedir/safe_mode bypass inside the compress.bzip2 wraper).</li> +<li>Fixed MOPB-8-2007 (XSS in phpinfo()).</li> +<li>Fixed CVE-2007-1001 (GD wbmp used with invalid image size).</li> +<li>Fixed CVE-2007-0455 (Buffer overflow in gdImageStringFTEx, used by imagettf function).</li> +<li><?php bugfix(41252); ?> (Calling mcrypt_generic without first calling mcrypt_generic_init crashes).</li> +<li><?php bugfix(40998); ?> (long session array keys are truncated).</li> +<li><?php bugfix(40915); ?> (addcslashes unexpected behavior with binary input).</li> +<li><?php bugfix(40831); ?> (cURL extension doesn't clean up the buffer of reused handle).</li> +<li><?php bugfix(40747); ?> (possible crash in session when save_path is out of open_basedir).</li> +<li><?php bugfix(38236); ?> (Binary data gets corrupted on multipart/formdata POST).</li> +<li>Fixed huge CPU usage in imagearc when used with large angles (libgd bug #74).</li> +<li>Fixed CRLF injection inside ftp_putcmd().</li> +</ul> + +<hr /> + <a name="4.4.6"></a> <h3>Version 4.4.6</h3> <b>01-Mar-2007</b> http://cvs.php.net/viewvc.cgi/phpweb/ChangeLog-5.php?r1=1.44&r2=1.45&diff_format=u Index: phpweb/ChangeLog-5.php diff -u phpweb/ChangeLog-5.php:1.44 phpweb/ChangeLog-5.php:1.45 --- phpweb/ChangeLog-5.php:1.44 Sun Feb 11 15:09:08 2007 +++ phpweb/ChangeLog-5.php Thu May 3 23:31:49 2007 @@ -1,5 +1,5 @@ <?php -// $Id: ChangeLog-5.php,v 1.44 2007/02/11 15:09:08 bjori Exp $ +// $Id: ChangeLog-5.php,v 1.45 2007/05/03 23:31:49 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'ChangeLog-5.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5 ChangeLog"); @@ -11,6 +11,202 @@ <hr /> +<a name="5.2.2"></a> +<h3>Version 5.2.2</h3> +<b>03-May-2007</b> +<ul> +<li>Security Fixes + <ul> + <li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric) (Pierre)</li> + <li>Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser) (Ilia)</li> + <li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser) (Ilia)</li> + <li>Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser) (Stas)</li> + <li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser) (Ilia)</li> + <li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser) (Stas)</li> + <li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser) (Ilia)</li> + <li>Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-20, MOPB-21 by Stefan Esser). (Ilia)</li> + <li>Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)</li> + <li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser) (Stas)</li> + <li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team) (Ilia)</li> + <li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Steffan Esser) (Ilia)</li> + <li>Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (Ilia)</li> + <li>Fixed a buffer overflow inside user_filter_factory_create(). (Ilia)</li> + <li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (Stas)</li> + </ul> +</li> + +<li>Improved bundled GD + <ul> + <li>Sync to 2.0.35</li> + <li>Added imagegrabwindow and imagegrabscreen, capture a screen or a window using its handle (Pierre)</li> + <li>colors allocated henceforth from the resulting image overwrite the palette colors (Rob Leslie)</li> + <li>Improved thread safety of the gif support (Roman Nemecek, Nuno, Pierre) + <ul> + <li>Use the dimension of the GIF frame to create the destination image (Pierre)</li> + <li>Load only once the local color map from a GIF data (Pierre)</li> + </ul> + </li> + <li>Improved thread safety of the freetype cache (Scott MacVicar, Nuno, Pierre) + <ul> + <li>imagearc huge CPU usage with large angles, libgd bug #74 (Pierre)</li> + </ul> + </ul> + </li> +<li>Improved FastCGI SAPI to support external pipe and socket servers on win32. (Dmitry)</li> +<li>Improved Zend Memory Manager + <ul> + <li>guarantee of reasonable time for worst cases of best-fit free block searching algorithm. (Dmitry)</li> + <li>better cache usage and less fragmentation on erealloc() (Tony, Dmitry)</li> + </ul> +</li> +<li>Improved SPL (Marcus) + <ul> + <li>Added SplFileInfo::getBasename(), DirectoryIterator::getBasename().</li> + <li>Added SplFileInfo::getLinkTarget(), SplFileInfo::getRealPath().</li> + <li>Made RecursiveFilterIterator::accept() abstract as stated in documentation.</li> + </ul> +</li> +<li>Improved SOAP + <ul> + <li>Added ability to encode arrays with "SOAP-ENC:Array" type instead of WSDL type. To activate the ability use "feature"=>SOAP_USE_XSI_ARRAY_TYPE option in SoapClient/SoapServer constructors. (Rob, Dmitry)</li> + </ul> +</li> +<li>Added GMP_VERSION constant. (Tony)</li> +<li>Added --ri switch to CLI which allows to check extension information. (Marcus)</li> +<li>Added tidyNode::getParent() method (John, Nuno)</li> +<li>Added openbasedir and safemode checks in zip:// stream wrapper and ZipArchive::open (Pierre)</li> +<li>Added php_pdo_sqlite_external.dll, a version of the PDO SQLite driver that links against an external sqlite3.dll. This provides Windows users to upgrade their sqlite3 version outside of the PHP release cycle. (Wez, Edin)</li> +<li>Added linenumbers to array returned by token_get_all(). (Johannes)</li> + +<li>Implement #40947, allow a single filter as argument for filter_var_array (Pierre)</li> +<li>Implement #39867 (openssl PKCS#12 support) (Marc Delling, Pierre)</li> + +<li>Upgraded SQLite 3 to version 3.3.16 (Ilia)</li> +<li>Upgraded libraries bundled in the Windows distribution. (Edin) + <ul> + <li>c-client (imap) to version 2006e</li> + <li>libpq (PostgreSQL) to version 8.2.3</li> + <li>libmysql (MySQL) to version 5.0.37</li> + <li>openssl to version 0.9.8e</li> + </ul> +</li> +<li>Upgraded PCRE to version 7.0 (Nuno)</li> +<li>Updated timezone database to version 2007.5. (Derick)</li> + +<li>Fixed commandline handling for CLI and CGI. (Marcus, Johannes)</li> +<li>Fixed iterator_apply() with a callback using __call(). (Johannes)</li> +<li>Fixed possible multi bytes issues in openssl csr parser (Pierre)</li> +<li>Fixed shmop_open() with IPC_CREAT|IPC_EXCL flags on Windows. (Vladimir Kamaev, Tony).</li> +<li>Fixed possible leak in ZipArchive::extractTo when safemode checks fails (Ilia)</li> +<li>Fixed possible relative path issues in zip_open and TS mode (old API) (Pierre)</li> +<li>Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)</li> +<li>Fixed a thread safety issue in gd gif read code (Nuno, Roman Nemecek)</li> +<li>Fixed crash on op-assign where argument is string offset (Brian, Stas)</li> + + +<li><?php bugfix(41215); ?> (setAttribute return code reversed). (Ilia)</li> +<li><?php bugfix(41192); ?> (Per Directory Values only work for one key). (Dmitry)</li> +<li><?php bugfix(41175); ?> (addAttribute() fails to add an attribute with an empty value). (Ilia)</li> +<li><?php bugfix(41159); ?> (mysql_pconnect() hash does not account for connect flags). (Ilia)</li> +<li><?php bugfix(41121); ?> (range() overflow handling for large numbers on 32bit machines). (Ilia)</li> +<li><?php bugfix(41118); ?> (PHP does not handle overflow of octal integers). (Tony)</li> +<li><?php bugfix(41109); ?> (recursiveiterator.inc says "implements" Iterator instead of "extends"). (Marcus)</li> +<li><?php bugfix(40130); ?> (TTF usage doesn't work properly under Netware). (Scott, gk at gknw dot de)</li> +<li><?php bugfix(41093); ?> (magic_quotes_gpc ignores first arrays keys). (Arpad, Ilia)</li> +<li><?php bugfix(41075); ?> (memleak when creating default object caused exception). (Dmitry)</li> +<li><?php bugfix(41067); ?> (json_encode() problem with UTF-16 input). (jp at df5ea dot net. Ilia)</li> +<li><?php bugfix(41063); ?> (chdir doesn't like root paths). (Dmitry)</li> +<li><?php bugfix(41061); ?> ("visibility error" in ReflectionFunction::export()). (Johannes)</li> +<li><?php bugfix(41043); ?> (pdo_oci crash when freeing error text with persistent connection). (Tony)</li> +<li><?php bugfix(41037); ?> (unregister_tick_function() inside the tick function crash PHP). (Tony)</li> +<li><?php bugfix(41034); ?> (json_encode() ignores null byte started keys in arrays). (Ilia)</li> +<li><?php bugfix(41026); ?> (segfault when calling "self::method()" in shutdown functions). (Tony)</li> +<li><?php bugfix(40999); ?> (mcrypt_create_iv() not using random seed). (Ilia)</li> +<li><?php bugfix(40998); ?> (long session array keys are truncated). (Tony)</li> +<li><?php bugfix(40935); ?> (pdo_mysql does not raise an exception on empty fetchAll()). (Ilia)</li> +<li><?php bugfix(40931); ?> (open_basedir bypass via symlink and move_uploaded_file()). (Tony)</li> +<li><?php bugfix(40921); ?> (php_default_post_reader crashes when post_max_size is exceeded). (trickie at gmail dot com, Ilia)</li> +<li><?php bugfix(40915); ?> (addcslashes unexpected behavior with binary input). (Tony)</li> +<li><?php bugfix(40899); ?> (memory leak when nesting list()). (Dmitry)</li> +<li><?php bugfix(40897); ?> (error_log file not locked). (Ilia)</li> +<li><?php bugfix(40883); ?> (mysql_query() is allocating memory incorrectly). (Tony)</li> +<li><?php bugfix(40872); ?> (inconsistency in offsetSet, offsetExists treatment of string enclosed integers). (Marcus)</li> +<li><?php bugfix(40861); ?> (strtotime() doesn't handle double negative relative time units correctly). (Derick, Ilia)</li> +<li><?php bugfix(40854); ?> (imap_mail_compose() creates an invalid terminator for multipart e-mails). (Ilia)</li> +<li><?php bugfix(40848); ?> (sorting issue on 64-bit Solaris). (Wez)</li> +<li><?php bugfix(40836); ?> (Segfault in ext/dom). (Rob)</li> +<li><?php bugfix(40833); ?> (Crash when using unset() on an ArrayAccess object retrieved via __get()). (Dmitry)</li> +<li><?php bugfix(40822); ?> (pdo_mysql does not return rowCount() on select). (Ilia)</li> +<li><?php bugfix(40815); ?> (using strings like "class::func" and static methods in set_exception_handler() might result in crash). (Tony)</li> +<li><?php bugfix(40809); ?> (Poor performance of ".="). (Dmitry)</li> +<li><?php bugfix(40805); ?> (Failure executing function ibase_execute()). (Tony)</li> +<li><?php bugfix(40800); ?> (cannot disable memory_limit with -1). (Dmitry, Tony)</li> +<li><?php bugfix(40794); ?> (ReflectionObject::getValues() may crash when used with dynamic properties). (Tony)</li> +<li><?php bugfix(40784); ?> (Case sensitivity in constructor's fallback). (Tony)</li> +<li><?php bugfix(40770); ?> (Apache child exits when PHP memory limit reached). (Dmitry)</li> +<li><?php bugfix(40764); ?> (line thickness not respected for horizontal and vertical lines). (Pierre)</li> +<li><?php bugfix(40758); ?> (Test fcgi_is_fastcgi() is wrong on windows). (Dmitry)</li> +<li><?php bugfix(40754); ?> (added substr() & substr_replace() overflow checks). (Ilia)</li> +<li><?php bugfix(40752); ?> (parse_ini_file() segfaults when a scalar setting is redeclared as an array). (Tony)</li> +<li><?php bugfix(40750); ?> (openssl stream wrapper ignores default_stream_timeout). (Tony)</li> +<li><?php bugfix(40727); ?> (segfault in PDO when failed to bind parameters). (Tony)</li> +<li><?php bugfix(40709); ?> (array_reduce() behaves strange with one item stored arrays). (Ilia)</li> +<li><?php bugfix(40703); ?> (Resolved a possible namespace conflict between libxmlrpc and MySQL's NDB table handler). (Ilia)</li> +<li><?php bugfix(40961); ?> (Incorrect results of DateTime equality check). (Mike)</li> +<li><?php bugfix(40678); ?> (Cross compilation fails). (Tony)</li> +<li><?php bugfix(40621); ?> (Crash when constructor called inappropriately). (Tony)</li> +<li><?php bugfix(40609); ?> (Segfaults when using more than one SoapVar in a request). (Rob, Dmitry)</li> +<li><?php bugfix(40606); ?> (umask is not being restored when request is finished). (Tony)</li> +<li><?php bugfix(40598); ?> (libxml segfault). (Rob)</li> +<li><?php bugfix(40591); ?> (list()="string"; gives invalid opcode). (Dmitry)</li> +<li><?php bugfix(40578); ?> (imagettftext() multithreading issue). (Tony, Pierre)</li> +<li><?php bugfix(40576); ?> (double values are truncated to 6 decimal digits when encoding). (Tony)</li> +<li><?php bugfix(40560); ?> (DIR functions do not work on root UNC path). (Dmitry)</li> +<li><?php bugfix(40548); ?> (SplFileInfo::getOwner/getGroup give a warning on broken symlink). (Marcus)</li> +<li><?php bugfix(40546); ?> (SplFileInfo::getPathInfo() throws an exception if directory is in root dir). (Marcus)</li> +<li><?php bugfix(40545); ?> (multithreading issue in zend_strtod()). (Tony)</li> +<li><?php bugfix(40503); ?> (json_encode() value corruption on 32bit systems with overflown values). (Ilia)</li> +<li><?php bugfix(40467); ?> (Partial SOAP request sent when XSD sequence or choice include minOccurs=0). (Dmitry) </li> +<li><?php bugfix(40465); ?> (Ensure that all PHP elements are printed by var_dump). (wharmby at uk dot ibm dot com, Ilia)</li> +<li><?php bugfix(40464); ?> (session.save_path wont use default-value when safe_mode or open_basedir is enabled). (Ilia)</li> +<li><?php bugfix(40455); ?> (proc_open() uses wrong command line when safe_mode_exec_dir is set). (Tony)</li> +<li><?php bugfix(40432); ?> (strip_tags() fails with greater than in attribute). (Ilia)</li> +<li><?php bugfix(40431); ?> (dynamic properties may cause crash in ReflectionProperty methods). (Tony)</li> +<li><?php bugfix(40451); ?> (addAttribute() may crash when used with non-existent child node). (Tony)</li> +<li><?php bugfix(40442); ?> (ArrayObject::offsetExists broke in 5.2.1, works in 5.2.0). (olivier at elma dot fr, Marcus)</li> +<li><?php bugfix(40428); ?> (imagepstext() doesn't accept optional parameter). (Pierre)</li> +<li><?php bugfix(40417); ?> (Allow multiple instances of the same named PDO token in prepared statement emulation code). (Ilia)</li> +<li><?php bugfix(40414); ?> (possible endless fork() loop when running fastcgi). (Dmitry)</li> +<li><?php bugfix(40410); ?> (ext/posix does not compile on MacOS 10.3.9). (Tony)</li> +<li><?php bugfix(40392); ?> (memory leaks in PHP milter SAPI). (tuxracer69 at gmail dot com, Tony)</li> +<li><?php bugfix(40371); ?> (pg_client_encoding() not working on Windows). (Edin)</li> +<li><?php bugfix(40352); ?> (FCGI_WEB_SERVER_ADDRS function get lost). (Dmitry)</li> +<li><?php bugfix(40290); ?> (strtotime() returns unexpected result with particular timezone offset). (Derick)</li> +<li><?php bugfix(40286); ?> (PHP fastcgi with PHP_FCGI_CHILDREN don't kill children when parent is killed). (Dmitry)</li> +<li><?php bugfix(40261); ?> (Extremely slow data handling due to memory fragmentation). (Dmitry)</li> +<li><?php bugfix(40236); ?> (php -a function allocation eats memory). (Dmitry)</li> +<li><?php bugfix(40109); ?> (iptcembed fails on non-jfif jpegs). (Tony)</li> +<li><?php bugfix(39965); ?> (Latitude and longitude are backwards in date_sun_info()). (Derick)</li> +<li><?php bugfix(39836); ?> (SplObjectStorage empty after unserialize). (Marcus)</li> +<li><?php bugfix(39416); ?> (Milliseconds in date()). (Derick)</li> +<li><?php bugfix(39396); ?> (stream_set_blocking crashes on Win32). (Ilia, maurice at iceblog dot de)</li> +<li><?php bugfix(39351); ?> (relative include fails on Solaris). (Dmitry, Tony)</li> +<li><?php bugfix(39322); ?> (proc_terminate() destroys process resource). (Nuno)</li> +<li><?php bugfix(38406); ?> (crash when assigning objects to SimpleXML attributes). (Tony)</li> +<li><?php bugfix(37799); ?> (ftp_ssl_connect() falls back to non-ssl connection). (Nuno)</li> +<li><?php bugfix(36496); ?> (SSL support in imap_open() not working on Windows). (Edin)</li> +<li><?php bugfix(36226); ?> (Inconsistent handling when passing nillable arrays). (Dmitry)</li> +<li><?php bugfix(35872); ?> (Avoid crash caused by object store being referenced during RSHUTDOWN). (Andy) </li> +<li><?php bugfix(34794); ?> (proc_close() hangs when used with two processes). (jdolecek at netbsd dot org, Nuno)</li> +<li><?php bugfix(38710); ?> (data leakage because of nonexisting boundary checking in statements in mysqli) (Stas)</li> +<li><?php bugfix(37386); ?> (autocreating element doesn't assign value to first node). (Rob)</li> +<li><?php bugfix(37013); ?> (server hangs when returning circular object references). (Dmitry)</li> +<li><?php bugfix(33664); ?> Console window appears when using exec() (Richard Quadling, Stas)</li> +<li>Fixed PECL bug #10194 (crash in Oracle client when memory limit reached in the callback). (Tony)</li> +</ul> + +<hr /> + <a name="5.2.1"></a> <h3>Version 5.2.1</h3> <b>08-Feb-2007</b> http://cvs.php.net/viewvc.cgi/phpweb/index.php?r1=1.886&r2=1.887&diff_format=u Index: phpweb/index.php diff -u phpweb/index.php:1.886 phpweb/index.php:1.887 --- phpweb/index.php:1.886 Sat Apr 21 11:53:51 2007 +++ phpweb/index.php Thu May 3 23:31:49 2007 @@ -230,6 +230,70 @@ // DO NOT REMOVE THIS COMMENT (the RSS parser is dependant on it) ?> +<a name="5"></a> +<h1>PHP 5.2.2 and PHP 4.4.7 Released</h1> +<p> + <span class="newsdate">[03-May-2007]</span> + The PHP development team would like to announce the immediate <a + href="/downloads.php#v5">availability of PHP 5.2.2</a> and <a + href="/downloads.php#v4">availability of PHP 4.4.7</a>. + These releases are major stability and security enhancements of the 5.x and + 4.4.x branches, and all users are strongly encouraged to upgrade to it as + soon as possible. Further details about the PHP 5.2.2 release can be found in the <a + href="/releases/5_2_2.php">release announcement for 5.2.2</a>, the full list of + changes is available in the <a href="/ChangeLog-5.php#5.2.2">ChangeLog for PHP + 5</a>. Details about the PHP 4.4.7 release can be found in the <a + href="/releases/4_4_7.php">release announcement for 4.4.7</a>, the full list of + changes is available in the <a href="/ChangeLog-4.php#4.4.7">ChangeLog for PHP + 4</a>. +</p> + +<p> +<b>Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:</b> +</p> +<ul> + <li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)</li> + <li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)</li> + <li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)</li> + <li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)</li> + <li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)</li> + <li>Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser).</li> + <li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)</li> + <li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)</li> + <li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser)</li> + <li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)</li> +</ul> +<p> +<b>Security Enhancements and Fixes in PHP 5.2.2 only:</b> +</p> +<ul> + <li>Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser)</li> + <li>Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser)</li> + <li>Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)</li> + <li>Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (by Ilia Alshanetsky)</li> + <li>Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia Alshanetsky)</li> +</ul> +<p> +<b>Security Enhancements and Fixes in PHP 4.4.7 only:</b> +</p> +<ul> + <li>XSS in phpinfo() (MOPB-8 by Stefan Esser)</li> +</ul> + +<p> +While majority of the issues outlined above are local, in some circumstances +given specific code paths they can be triggered externally. Therefor, we +strongly recommend that if you use code utilizing the functions and extensions +identified as having had vulnerabilities in them, you consider upgrading your PHP. +</p> + +<p> +For users upgrading to PHP 5.2 from PHP 5.0 and PHP 5.1, an upgrade guide is +available <a href="/migration52">here</a>, detailing the changes between +those releases and PHP 5.2.2. +</p> + +<hr /> <a name="6"></a> <h1>The PHP.net Google Summer of Code</h1> <p> @@ -410,31 +474,6 @@ <hr /> -<a name="1"></a> -<h1>PHP 5.2.0 Released</h1> -<p> - <span class="newsdate">[02-Nov-2006]</span> - The PHP development team is proud to announce the immediate release of PHP - 5.2.0. This release is a major improvement in the 5.X series, which includes a - large number of new features, bug fixes and security enhancements. - Further details about this release can be found in the release announcement - <a href="/releases/5_2_0.php">5.2.0</a>, the full list of changes is - available in the ChangeLog <a href="/ChangeLog-5.php#5.2.0">PHP 5</a>. -</p> -<p> -All users of PHP, especially those using earlier PHP 5 releases are advised -to upgrade to this release as soon as possible. This release also obsoletes -the 5.1 branch of PHP. -</p> - -<p> -For users upgrading from PHP 5.0 and PHP 5.1 there is an upgrading guide -available <a href="/UPDATE_5_2.txt">here</a>, detailing the changes between those releases -and PHP 5.2.0. -</p> - -<hr /> - <p class="center"><a href="/archive/index.php">News Archive</a></p> <?php http://cvs.php.net/viewvc.cgi/phpweb/include/version.inc?r1=1.9&r2=1.10&diff_format=u Index: phpweb/include/version.inc diff -u phpweb/include/version.inc:1.9 phpweb/include/version.inc:1.10 --- phpweb/include/version.inc:1.9 Fri Apr 27 01:34:46 2007 +++ phpweb/include/version.inc Thu May 3 23:31:50 2007 @@ -17,25 +17,25 @@ */ /* PHP 5 Release */ -$PHP_5_VERSION = "5.2.1"; -$PHP_5_DATE = "08 Feb 2007"; +$PHP_5_VERSION = "5.2.2"; +$PHP_5_DATE = "03 May 2007"; $PHP_5_MD5 = array( - "tar.bz2" => "261218e3569a777dbd87c16a15f05c8d", - "tar.gz" => "604eaee2b834bb037d2c83e53e300d3f", - "zip" => "682dd66fb03c7dd24c522f474e1b04b6", - "installer" => "f0a1445f4adfdc2e00a81b2eb788be5c", - "pecl.zip" => "dc8b394146faf7effa6f26df02e8e534", - "nts.zip" => "815c8c61af58fffdc34d34c24310ffe2", - "pecl.nts" => "ffd78a31a704d68c8adadc9288261583", + "tar.bz2" => "d084337867d70b50a10322577be0e44e", + "tar.gz" => "7a920d0096900b2b962b21dc5c55fe3c", + "zip" => "634cf45c34f80dfb1284cabf1bbb1417", + "installer" => "eea060523d095ae421409e8a9c343207", + "pecl.zip" => "5d206368799dfbac983d83954328ae3a", + "nts.zip" => "b9abde6658b91ab66acb26eca699b5f6", + "pecl.nts" => "902360747287abaf4c8906efb609f2f8", ); /* PHP 4 Release */ -$PHP_4_VERSION = "4.4.6"; -$PHP_4_DATE = "01 Mar 2007"; +$PHP_4_VERSION = "4.4.7"; +$PHP_4_DATE = "03 May 2007"; $PHP_4_MD5 = array( - "tar.bz2" => "5db283824310c87efb18c76b4735c4bd", - "tar.gz" => "07c607fcf12435f0078d72fe0de4e3c0", - "zip" => "486764cefb5f7bde39e95c49b2e38635", + "tar.bz2" => "3f21b44d37a57ca3876d3aea713c700d", + "tar.gz" => "2669d2049822ac14abb263703d24f643", + "zip" => "e774e79530d610c58c5f2da433d14e0f", ); $RELEASES = array( @@ -67,8 +67,7 @@ "filename" => "php-$PHP_5_VERSION-win32-installer.msi", "name" => "PHP $PHP_5_VERSION installer", "md5" => $PHP_5_MD5["installer"], - "date" => "12 Feb 2007", # $PHP_5_DATE, - "note" => "This file was updated February 12th to fix problems when upgrading from previous PHP versions.", + "date" => $PHP_5_DATE, ), array( "filename" => "pecl-$PHP_5_VERSION-Win32.zip", @@ -91,7 +90,7 @@ ), ), ), - "5.2.2RC2" => array(), /* Yes, it should be empty - unless we want it in the version feed? */ +// "5.2.3" => array(), /* Yes, it should be empty - unless we want it in the version feed? */ ), 4 => array( $PHP_4_VERSION => array( @@ -120,7 +119,7 @@ ), ), ), - "4.4.7RC1" => array(), /* Yes, it should be empty.. unless we want it in the version feed..? */ +// "4.4.7RC1" => array(), /* Yes, it should be empty.. unless we want it in the version feed..? */ ), ); http://cvs.php.net/viewvc.cgi/phpweb/releases/index.php?r1=1.9&r2=1.10&diff_format=u Index: phpweb/releases/index.php diff -u phpweb/releases/index.php:1.9 phpweb/releases/index.php:1.10 --- phpweb/releases/index.php:1.9 Thu May 3 18:27:31 2007 +++ phpweb/releases/index.php Thu May 3 23:31:50 2007 @@ -1,5 +1,5 @@ <?php -// $Id: index.php,v 1.9 2007/05/03 18:27:31 bjori Exp $ +// $Id: index.php,v 1.10 2007/05/03 23:31:50 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/index.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; @@ -80,6 +80,7 @@ <option value="php-4.4.3.tar.gz">4.4.3</option> <option value="php-4.4.4.tar.gz">4.4.4</option> <option value="php-4.4.5.tar.gz">4.4.5</option> + <option value="php-4.4.6.tar.gz">4.4.6</option> <option value="">--------</option> <option value="php-5.0.0.tar.gz">5.0.0</option> <option value="php-5.0.1.tar.gz">5.0.1</option> @@ -95,6 +96,7 @@ <option value="php-5.1.5.tar.gz">5.1.5</option> <option value="php-5.1.6.tar.gz">5.1.6</option> <option value="php-5.2.0.tar.gz">5.2.0</option> + <option value="php-5.2.1.tar.gz">5.2.1</option> </select> </p> </form> @@ -114,6 +116,38 @@ </p> <a name="v5"></a> +<a name="5.2.1"></a> +<h2>5.2.1</h2> + +<ul> + <li>Released: 08 Feb 2007</li> + <li>Announcement: <a href="/releases/5_2_1.php">English</a></li> + <li><a href="/ChangeLog-5.php#5.2.1">ChangeLog</a></li> + <li> + Download: + <ul> + <li> + <?php download_link('php-5.2.1.tar.bz2','Source (tar.bz2)'); ?><br /> + <span class="md5sum">md5: 261218e3569a777dbd87c16a15f05c8d</span> + </li> + <li> + <?php download_link('php-5.2.1.tar.gz','Source (tar.gz)'); ?><br /> + <span class="md5sum">md5: 604eaee2b834bb037d2c83e53e300d3f</span> + </li> + <li> + <?php download_link('php-5.2.1-Win32.zip','Windows binary'); ?><br /> + <span class="md5sum">md5: 682dd66fb03c7dd24c522f474e1b04b6</span> + </li> + <li> + <?php download_link('pecl-5.2.1-Win32.zip','Collection of PECL modules for PHP 5.2.1'); ?><br /> + <span class="md5sum">md5: dc8b394146faf7effa6f26df02e8e534</span> + </li> + </ul> + </li> +</ul> + + +<a name="v5"></a> <a name="5.2.0"></a> <h2>5.2.0</h2> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_4_7.php?view=markup&rev=1.1 Index: phpweb/releases/4_4_7.php +++ phpweb/releases/4_4_7.php <?php // $Id: 4_4_7.php,v 1.1 2007/05/03 23:31:50 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_4_7.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.4.7 Release Announcement"); ?> <h1>PHP 4.4.7 Release Announcement</h1> <p> The PHP development team would like to announce the immediate availability of PHP 4.4.7. This release continues to improve the security and the stability of the 4.4 branch and all users are strongly encouraged to upgrade to it as soon as possible. </p> <p> <b>Security Enhancements and Fixes in PHP 4.4.7:</b> </p> <ul> <li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)</li> <li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)</li> <li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)</li> <li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)</li> <li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)</li> <li>Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser).</li> <li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)</li> <li>XSS in phpinfo() (MOPB-8 by Stefan Esser)</li> <li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)</li> <li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser)</li> <li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)</li> </ul> <p> While majority of the issues outlined above are local, few issues such as the XML-RPC overflows can be triggered remotely and therefor should be considered critical. If you use the XML-RPC extension consider upgrading as soon as possible. </p> <p> <b>Other improvements of PHP 4.4.7 include:</b> </p> <ul> <li>About 10 bug fixes.</li> </ul> <p> For a full list of changes in PHP 4.4.7, see the <a href="/ChangeLog-4.php#4.4.7">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_2_2.php?view=markup&rev=1.1 Index: phpweb/releases/5_2_2.php +++ phpweb/releases/5_2_2.php <?php // $Id: 5_2_2.php,v 1.1 2007/05/03 23:31:50 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_2_2.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.2.2 Release Announcement"); ?> <h1>PHP 5.2.2 Release Announcement</h1> <p> The PHP development team would like to announce the immediate availability of PHP 5.2.2. This release continues to improve the security and the stability of the 5.X branch and all users are strongly encouraged to upgrade to it as soon as possible. </p> <p> <b>Security Enhancements and Fixes in PHP 5.2.2:</b> </p> <ul> <li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)</li> <li>Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser)</li> <li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)</li> <li>Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser)</li> <li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)</li> <li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)</li> <li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)</li> <li>Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-20, MOPB-21 by Stefan Esser).</li> <li>Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)</li> <li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)</li> <li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)</li> <li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Steffan Esser)</li> <li>Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (by Ilia Alshanetsky)</li> <li>Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia Alshanetsky)</li> <li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)</li> </ul> <p> While majority of the issues outlined above are local, in some circumstances given specific code paths they can be triggered externally. Therefor, we strongly recommend that if you use code utilizing the functions and extensions identified as having had vulnerabilities in them, you consider upgrading your PHP. </p> <p> <b>The key improvements of PHP 5.2.2 include:</b> </p> <ul> <li>Further improvements to the Memory Manager with the goal of improving realloc() performance.</li> <li>Bundled GD, SQLite and PCRE libraries were upgraded.</li> <li>Additional methods were added to SPL's DirectoryIterator and SplFileInfo classes.</li> <li>Over 120 bug fixes.</li> </ul> <p> For users upgrading from PHP 5.0 and PHP 5.1, an upgrade guide is available <a href="/UPDATE_5_2.txt">here</a>, detailing the changes between those releases and PHP 5.2.2. </p> <p> For a full list of changes in PHP 5.2.2, see the <a href="/ChangeLog-5.php#5.2.2">ChangeLog</a>. </p> <?php site_footer(); ?>
http://cvs.php.net/viewvc.cgi/phpweb/ChangeLog-4.php?r1=1.69&r2=1.70&diff_format=u Index: phpweb/ChangeLog-4.php diff -u phpweb/ChangeLog-4.php:1.69 phpweb/ChangeLog-4.php:1.70 --- phpweb/ChangeLog-4.php:1.69 Thu Mar 1 08:48:16 2007 +++ phpweb/ChangeLog-4.php Thu May 3 23:31:49 2007 @@ -1,5 +1,5 @@ <?php -// $Id: ChangeLog-4.php,v 1.69 2007/03/01 08:48:16 derick Exp $ +// $Id: ChangeLog-4.php,v 1.70 2007/05/03 23:31:49 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'ChangeLog-4.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4 ChangeLog"); @@ -11,6 +11,31 @@ <hr/> +<a name="4.4.7"></a> +<h3>Version 4.4.7</h3> +<b>03-May-2007</b> +<ul> +<li>Fixed MOPB-33-2007 (PHP mail() Message ASCIIZ Byte Truncation).</li> +<li>Fixed MOPB-32-2007 (Double free inside session_decode()).</li> +<li>Fixed MOPB-26-2007 (mb_parse_str() can be used to activate register_globals).</li> +<li>Fixed MOPB-24-2007 (Fixed unallocated memory access/double free in in array_user_key_compare()).</li> +<li>Fixed MOPB-22-2007 (PHP session_regenerate_id() Double Free Vulnerability).</li> +<li>Fixed MOPB-21-2007 (An open_basedir/safe_mode bypass inside the compress.bzip2 wraper).</li> +<li>Fixed MOPB-8-2007 (XSS in phpinfo()).</li> +<li>Fixed CVE-2007-1001 (GD wbmp used with invalid image size).</li> +<li>Fixed CVE-2007-0455 (Buffer overflow in gdImageStringFTEx, used by imagettf function).</li> +<li><?php bugfix(41252); ?> (Calling mcrypt_generic without first calling mcrypt_generic_init crashes).</li> +<li><?php bugfix(40998); ?> (long session array keys are truncated).</li> +<li><?php bugfix(40915); ?> (addcslashes unexpected behavior with binary input).</li> +<li><?php bugfix(40831); ?> (cURL extension doesn't clean up the buffer of reused handle).</li> +<li><?php bugfix(40747); ?> (possible crash in session when save_path is out of open_basedir).</li> +<li><?php bugfix(38236); ?> (Binary data gets corrupted on multipart/formdata POST).</li> +<li>Fixed huge CPU usage in imagearc when used with large angles (libgd bug #74).</li> +<li>Fixed CRLF injection inside ftp_putcmd().</li> +</ul> + +<hr /> + <a name="4.4.6"></a> <h3>Version 4.4.6</h3> <b>01-Mar-2007</b> http://cvs.php.net/viewvc.cgi/phpweb/ChangeLog-5.php?r1=1.44&r2=1.45&diff_format=u Index: phpweb/ChangeLog-5.php diff -u phpweb/ChangeLog-5.php:1.44 phpweb/ChangeLog-5.php:1.45 --- phpweb/ChangeLog-5.php:1.44 Sun Feb 11 15:09:08 2007 +++ phpweb/ChangeLog-5.php Thu May 3 23:31:49 2007 @@ -1,5 +1,5 @@ <?php -// $Id: ChangeLog-5.php,v 1.44 2007/02/11 15:09:08 bjori Exp $ +// $Id: ChangeLog-5.php,v 1.45 2007/05/03 23:31:49 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'ChangeLog-5.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5 ChangeLog"); @@ -11,6 +11,202 @@ <hr /> +<a name="5.2.2"></a> +<h3>Version 5.2.2</h3> +<b>03-May-2007</b> +<ul> +<li>Security Fixes + <ul> + <li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric) (Pierre)</li> + <li>Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser) (Ilia)</li> + <li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser) (Ilia)</li> + <li>Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser) (Stas)</li> + <li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser) (Ilia)</li> + <li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser) (Stas)</li> + <li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser) (Ilia)</li> + <li>Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-20, MOPB-21 by Stefan Esser). (Ilia)</li> + <li>Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)</li> + <li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser) (Stas)</li> + <li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team) (Ilia)</li> + <li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Steffan Esser) (Ilia)</li> + <li>Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (Ilia)</li> + <li>Fixed a buffer overflow inside user_filter_factory_create(). (Ilia)</li> + <li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (Stas)</li> + </ul> +</li> + +<li>Improved bundled GD + <ul> + <li>Sync to 2.0.35</li> + <li>Added imagegrabwindow and imagegrabscreen, capture a screen or a window using its handle (Pierre)</li> + <li>colors allocated henceforth from the resulting image overwrite the palette colors (Rob Leslie)</li> + <li>Improved thread safety of the gif support (Roman Nemecek, Nuno, Pierre) + <ul> + <li>Use the dimension of the GIF frame to create the destination image (Pierre)</li> + <li>Load only once the local color map from a GIF data (Pierre)</li> + </ul> + </li> + <li>Improved thread safety of the freetype cache (Scott MacVicar, Nuno, Pierre) + <ul> + <li>imagearc huge CPU usage with large angles, libgd bug #74 (Pierre)</li> + </ul> + </ul> + </li> +<li>Improved FastCGI SAPI to support external pipe and socket servers on win32. (Dmitry)</li> +<li>Improved Zend Memory Manager + <ul> + <li>guarantee of reasonable time for worst cases of best-fit free block searching algorithm. (Dmitry)</li> + <li>better cache usage and less fragmentation on erealloc() (Tony, Dmitry)</li> + </ul> +</li> +<li>Improved SPL (Marcus) + <ul> + <li>Added SplFileInfo::getBasename(), DirectoryIterator::getBasename().</li> + <li>Added SplFileInfo::getLinkTarget(), SplFileInfo::getRealPath().</li> + <li>Made RecursiveFilterIterator::accept() abstract as stated in documentation.</li> + </ul> +</li> +<li>Improved SOAP + <ul> + <li>Added ability to encode arrays with "SOAP-ENC:Array" type instead of WSDL type. To activate the ability use "feature"=>SOAP_USE_XSI_ARRAY_TYPE option in SoapClient/SoapServer constructors. (Rob, Dmitry)</li> + </ul> +</li> +<li>Added GMP_VERSION constant. (Tony)</li> +<li>Added --ri switch to CLI which allows to check extension information. (Marcus)</li> +<li>Added tidyNode::getParent() method (John, Nuno)</li> +<li>Added openbasedir and safemode checks in zip:// stream wrapper and ZipArchive::open (Pierre)</li> +<li>Added php_pdo_sqlite_external.dll, a version of the PDO SQLite driver that links against an external sqlite3.dll. This provides Windows users to upgrade their sqlite3 version outside of the PHP release cycle. (Wez, Edin)</li> +<li>Added linenumbers to array returned by token_get_all(). (Johannes)</li> + +<li>Implement #40947, allow a single filter as argument for filter_var_array (Pierre)</li> +<li>Implement #39867 (openssl PKCS#12 support) (Marc Delling, Pierre)</li> + +<li>Upgraded SQLite 3 to version 3.3.16 (Ilia)</li> +<li>Upgraded libraries bundled in the Windows distribution. (Edin) + <ul> + <li>c-client (imap) to version 2006e</li> + <li>libpq (PostgreSQL) to version 8.2.3</li> + <li>libmysql (MySQL) to version 5.0.37</li> + <li>openssl to version 0.9.8e</li> + </ul> +</li> +<li>Upgraded PCRE to version 7.0 (Nuno)</li> +<li>Updated timezone database to version 2007.5. (Derick)</li> + +<li>Fixed commandline handling for CLI and CGI. (Marcus, Johannes)</li> +<li>Fixed iterator_apply() with a callback using __call(). (Johannes)</li> +<li>Fixed possible multi bytes issues in openssl csr parser (Pierre)</li> +<li>Fixed shmop_open() with IPC_CREAT|IPC_EXCL flags on Windows. (Vladimir Kamaev, Tony).</li> +<li>Fixed possible leak in ZipArchive::extractTo when safemode checks fails (Ilia)</li> +<li>Fixed possible relative path issues in zip_open and TS mode (old API) (Pierre)</li> +<li>Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)</li> +<li>Fixed a thread safety issue in gd gif read code (Nuno, Roman Nemecek)</li> +<li>Fixed crash on op-assign where argument is string offset (Brian, Stas)</li> + + +<li><?php bugfix(41215); ?> (setAttribute return code reversed). (Ilia)</li> +<li><?php bugfix(41192); ?> (Per Directory Values only work for one key). (Dmitry)</li> +<li><?php bugfix(41175); ?> (addAttribute() fails to add an attribute with an empty value). (Ilia)</li> +<li><?php bugfix(41159); ?> (mysql_pconnect() hash does not account for connect flags). (Ilia)</li> +<li><?php bugfix(41121); ?> (range() overflow handling for large numbers on 32bit machines). (Ilia)</li> +<li><?php bugfix(41118); ?> (PHP does not handle overflow of octal integers). (Tony)</li> +<li><?php bugfix(41109); ?> (recursiveiterator.inc says "implements" Iterator instead of "extends"). (Marcus)</li> +<li><?php bugfix(40130); ?> (TTF usage doesn't work properly under Netware). (Scott, gk at gknw dot de)</li> +<li><?php bugfix(41093); ?> (magic_quotes_gpc ignores first arrays keys). (Arpad, Ilia)</li> +<li><?php bugfix(41075); ?> (memleak when creating default object caused exception). (Dmitry)</li> +<li><?php bugfix(41067); ?> (json_encode() problem with UTF-16 input). (jp at df5ea dot net. Ilia)</li> +<li><?php bugfix(41063); ?> (chdir doesn't like root paths). (Dmitry)</li> +<li><?php bugfix(41061); ?> ("visibility error" in ReflectionFunction::export()). (Johannes)</li> +<li><?php bugfix(41043); ?> (pdo_oci crash when freeing error text with persistent connection). (Tony)</li> +<li><?php bugfix(41037); ?> (unregister_tick_function() inside the tick function crash PHP). (Tony)</li> +<li><?php bugfix(41034); ?> (json_encode() ignores null byte started keys in arrays). (Ilia)</li> +<li><?php bugfix(41026); ?> (segfault when calling "self::method()" in shutdown functions). (Tony)</li> +<li><?php bugfix(40999); ?> (mcrypt_create_iv() not using random seed). (Ilia)</li> +<li><?php bugfix(40998); ?> (long session array keys are truncated). (Tony)</li> +<li><?php bugfix(40935); ?> (pdo_mysql does not raise an exception on empty fetchAll()). (Ilia)</li> +<li><?php bugfix(40931); ?> (open_basedir bypass via symlink and move_uploaded_file()). (Tony)</li> +<li><?php bugfix(40921); ?> (php_default_post_reader crashes when post_max_size is exceeded). (trickie at gmail dot com, Ilia)</li> +<li><?php bugfix(40915); ?> (addcslashes unexpected behavior with binary input). (Tony)</li> +<li><?php bugfix(40899); ?> (memory leak when nesting list()). (Dmitry)</li> +<li><?php bugfix(40897); ?> (error_log file not locked). (Ilia)</li> +<li><?php bugfix(40883); ?> (mysql_query() is allocating memory incorrectly). (Tony)</li> +<li><?php bugfix(40872); ?> (inconsistency in offsetSet, offsetExists treatment of string enclosed integers). (Marcus)</li> +<li><?php bugfix(40861); ?> (strtotime() doesn't handle double negative relative time units correctly). (Derick, Ilia)</li> +<li><?php bugfix(40854); ?> (imap_mail_compose() creates an invalid terminator for multipart e-mails). (Ilia)</li> +<li><?php bugfix(40848); ?> (sorting issue on 64-bit Solaris). (Wez)</li> +<li><?php bugfix(40836); ?> (Segfault in ext/dom). (Rob)</li> +<li><?php bugfix(40833); ?> (Crash when using unset() on an ArrayAccess object retrieved via __get()). (Dmitry)</li> +<li><?php bugfix(40822); ?> (pdo_mysql does not return rowCount() on select). (Ilia)</li> +<li><?php bugfix(40815); ?> (using strings like "class::func" and static methods in set_exception_handler() might result in crash). (Tony)</li> +<li><?php bugfix(40809); ?> (Poor performance of ".="). (Dmitry)</li> +<li><?php bugfix(40805); ?> (Failure executing function ibase_execute()). (Tony)</li> +<li><?php bugfix(40800); ?> (cannot disable memory_limit with -1). (Dmitry, Tony)</li> +<li><?php bugfix(40794); ?> (ReflectionObject::getValues() may crash when used with dynamic properties). (Tony)</li> +<li><?php bugfix(40784); ?> (Case sensitivity in constructor's fallback). (Tony)</li> +<li><?php bugfix(40770); ?> (Apache child exits when PHP memory limit reached). (Dmitry)</li> +<li><?php bugfix(40764); ?> (line thickness not respected for horizontal and vertical lines). (Pierre)</li> +<li><?php bugfix(40758); ?> (Test fcgi_is_fastcgi() is wrong on windows). (Dmitry)</li> +<li><?php bugfix(40754); ?> (added substr() & substr_replace() overflow checks). (Ilia)</li> +<li><?php bugfix(40752); ?> (parse_ini_file() segfaults when a scalar setting is redeclared as an array). (Tony)</li> +<li><?php bugfix(40750); ?> (openssl stream wrapper ignores default_stream_timeout). (Tony)</li> +<li><?php bugfix(40727); ?> (segfault in PDO when failed to bind parameters). (Tony)</li> +<li><?php bugfix(40709); ?> (array_reduce() behaves strange with one item stored arrays). (Ilia)</li> +<li><?php bugfix(40703); ?> (Resolved a possible namespace conflict between libxmlrpc and MySQL's NDB table handler). (Ilia)</li> +<li><?php bugfix(40961); ?> (Incorrect results of DateTime equality check). (Mike)</li> +<li><?php bugfix(40678); ?> (Cross compilation fails). (Tony)</li> +<li><?php bugfix(40621); ?> (Crash when constructor called inappropriately). (Tony)</li> +<li><?php bugfix(40609); ?> (Segfaults when using more than one SoapVar in a request). (Rob, Dmitry)</li> +<li><?php bugfix(40606); ?> (umask is not being restored when request is finished). (Tony)</li> +<li><?php bugfix(40598); ?> (libxml segfault). (Rob)</li> +<li><?php bugfix(40591); ?> (list()="string"; gives invalid opcode). (Dmitry)</li> +<li><?php bugfix(40578); ?> (imagettftext() multithreading issue). (Tony, Pierre)</li> +<li><?php bugfix(40576); ?> (double values are truncated to 6 decimal digits when encoding). (Tony)</li> +<li><?php bugfix(40560); ?> (DIR functions do not work on root UNC path). (Dmitry)</li> +<li><?php bugfix(40548); ?> (SplFileInfo::getOwner/getGroup give a warning on broken symlink). (Marcus)</li> +<li><?php bugfix(40546); ?> (SplFileInfo::getPathInfo() throws an exception if directory is in root dir). (Marcus)</li> +<li><?php bugfix(40545); ?> (multithreading issue in zend_strtod()). (Tony)</li> +<li><?php bugfix(40503); ?> (json_encode() value corruption on 32bit systems with overflown values). (Ilia)</li> +<li><?php bugfix(40467); ?> (Partial SOAP request sent when XSD sequence or choice include minOccurs=0). (Dmitry) </li> +<li><?php bugfix(40465); ?> (Ensure that all PHP elements are printed by var_dump). (wharmby at uk dot ibm dot com, Ilia)</li> +<li><?php bugfix(40464); ?> (session.save_path wont use default-value when safe_mode or open_basedir is enabled). (Ilia)</li> +<li><?php bugfix(40455); ?> (proc_open() uses wrong command line when safe_mode_exec_dir is set). (Tony)</li> +<li><?php bugfix(40432); ?> (strip_tags() fails with greater than in attribute). (Ilia)</li> +<li><?php bugfix(40431); ?> (dynamic properties may cause crash in ReflectionProperty methods). (Tony)</li> +<li><?php bugfix(40451); ?> (addAttribute() may crash when used with non-existent child node). (Tony)</li> +<li><?php bugfix(40442); ?> (ArrayObject::offsetExists broke in 5.2.1, works in 5.2.0). (olivier at elma dot fr, Marcus)</li> +<li><?php bugfix(40428); ?> (imagepstext() doesn't accept optional parameter). (Pierre)</li> +<li><?php bugfix(40417); ?> (Allow multiple instances of the same named PDO token in prepared statement emulation code). (Ilia)</li> +<li><?php bugfix(40414); ?> (possible endless fork() loop when running fastcgi). (Dmitry)</li> +<li><?php bugfix(40410); ?> (ext/posix does not compile on MacOS 10.3.9). (Tony)</li> +<li><?php bugfix(40392); ?> (memory leaks in PHP milter SAPI). (tuxracer69 at gmail dot com, Tony)</li> +<li><?php bugfix(40371); ?> (pg_client_encoding() not working on Windows). (Edin)</li> +<li><?php bugfix(40352); ?> (FCGI_WEB_SERVER_ADDRS function get lost). (Dmitry)</li> +<li><?php bugfix(40290); ?> (strtotime() returns unexpected result with particular timezone offset). (Derick)</li> +<li><?php bugfix(40286); ?> (PHP fastcgi with PHP_FCGI_CHILDREN don't kill children when parent is killed). (Dmitry)</li> +<li><?php bugfix(40261); ?> (Extremely slow data handling due to memory fragmentation). (Dmitry)</li> +<li><?php bugfix(40236); ?> (php -a function allocation eats memory). (Dmitry)</li> +<li><?php bugfix(40109); ?> (iptcembed fails on non-jfif jpegs). (Tony)</li> +<li><?php bugfix(39965); ?> (Latitude and longitude are backwards in date_sun_info()). (Derick)</li> +<li><?php bugfix(39836); ?> (SplObjectStorage empty after unserialize). (Marcus)</li> +<li><?php bugfix(39416); ?> (Milliseconds in date()). (Derick)</li> +<li><?php bugfix(39396); ?> (stream_set_blocking crashes on Win32). (Ilia, maurice at iceblog dot de)</li> +<li><?php bugfix(39351); ?> (relative include fails on Solaris). (Dmitry, Tony)</li> +<li><?php bugfix(39322); ?> (proc_terminate() destroys process resource). (Nuno)</li> +<li><?php bugfix(38406); ?> (crash when assigning objects to SimpleXML attributes). (Tony)</li> +<li><?php bugfix(37799); ?> (ftp_ssl_connect() falls back to non-ssl connection). (Nuno)</li> +<li><?php bugfix(36496); ?> (SSL support in imap_open() not working on Windows). (Edin)</li> +<li><?php bugfix(36226); ?> (Inconsistent handling when passing nillable arrays). (Dmitry)</li> +<li><?php bugfix(35872); ?> (Avoid crash caused by object store being referenced during RSHUTDOWN). (Andy) </li> +<li><?php bugfix(34794); ?> (proc_close() hangs when used with two processes). (jdolecek at netbsd dot org, Nuno)</li> +<li><?php bugfix(38710); ?> (data leakage because of nonexisting boundary checking in statements in mysqli) (Stas)</li> +<li><?php bugfix(37386); ?> (autocreating element doesn't assign value to first node). (Rob)</li> +<li><?php bugfix(37013); ?> (server hangs when returning circular object references). (Dmitry)</li> +<li><?php bugfix(33664); ?> Console window appears when using exec() (Richard Quadling, Stas)</li> +<li>Fixed PECL bug #10194 (crash in Oracle client when memory limit reached in the callback). (Tony)</li> +</ul> + +<hr /> + <a name="5.2.1"></a> <h3>Version 5.2.1</h3> <b>08-Feb-2007</b> http://cvs.php.net/viewvc.cgi/phpweb/index.php?r1=1.886&r2=1.887&diff_format=u Index: phpweb/index.php diff -u phpweb/index.php:1.886 phpweb/index.php:1.887 --- phpweb/index.php:1.886 Sat Apr 21 11:53:51 2007 +++ phpweb/index.php Thu May 3 23:31:49 2007 @@ -230,6 +230,70 @@ // DO NOT REMOVE THIS COMMENT (the RSS parser is dependant on it) ?> +<a name="5"></a> +<h1>PHP 5.2.2 and PHP 4.4.7 Released</h1> +<p> + <span class="newsdate">[03-May-2007]</span> + The PHP development team would like to announce the immediate <a + href="/downloads.php#v5">availability of PHP 5.2.2</a> and <a + href="/downloads.php#v4">availability of PHP 4.4.7</a>. + These releases are major stability and security enhancements of the 5.x and + 4.4.x branches, and all users are strongly encouraged to upgrade to it as + soon as possible. Further details about the PHP 5.2.2 release can be found in the <a + href="/releases/5_2_2.php">release announcement for 5.2.2</a>, the full list of + changes is available in the <a href="/ChangeLog-5.php#5.2.2">ChangeLog for PHP + 5</a>. Details about the PHP 4.4.7 release can be found in the <a + href="/releases/4_4_7.php">release announcement for 4.4.7</a>, the full list of + changes is available in the <a href="/ChangeLog-4.php#4.4.7">ChangeLog for PHP + 4</a>. +</p> + +<p> +<b>Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:</b> +</p> +<ul> + <li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)</li> + <li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)</li> + <li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)</li> + <li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)</li> + <li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)</li> + <li>Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser).</li> + <li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)</li> + <li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)</li> + <li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser)</li> + <li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)</li> +</ul> +<p> +<b>Security Enhancements and Fixes in PHP 5.2.2 only:</b> +</p> +<ul> + <li>Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser)</li> + <li>Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser)</li> + <li>Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)</li> + <li>Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (by Ilia Alshanetsky)</li> + <li>Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia Alshanetsky)</li> +</ul> +<p> +<b>Security Enhancements and Fixes in PHP 4.4.7 only:</b> +</p> +<ul> + <li>XSS in phpinfo() (MOPB-8 by Stefan Esser)</li> +</ul> + +<p> +While majority of the issues outlined above are local, in some circumstances +given specific code paths they can be triggered externally. Therefor, we +strongly recommend that if you use code utilizing the functions and extensions +identified as having had vulnerabilities in them, you consider upgrading your PHP. +</p> + +<p> +For users upgrading to PHP 5.2 from PHP 5.0 and PHP 5.1, an upgrade guide is +available <a href="/migration52">here</a>, detailing the changes between +those releases and PHP 5.2.2. +</p> + +<hr /> <a name="6"></a> <h1>The PHP.net Google Summer of Code</h1> <p> @@ -410,31 +474,6 @@ <hr /> -<a name="1"></a> -<h1>PHP 5.2.0 Released</h1> -<p> - <span class="newsdate">[02-Nov-2006]</span> - The PHP development team is proud to announce the immediate release of PHP - 5.2.0. This release is a major improvement in the 5.X series, which includes a - large number of new features, bug fixes and security enhancements. - Further details about this release can be found in the release announcement - <a href="/releases/5_2_0.php">5.2.0</a>, the full list of changes is - available in the ChangeLog <a href="/ChangeLog-5.php#5.2.0">PHP 5</a>. -</p> -<p> -All users of PHP, especially those using earlier PHP 5 releases are advised -to upgrade to this release as soon as possible. This release also obsoletes -the 5.1 branch of PHP. -</p> - -<p> -For users upgrading from PHP 5.0 and PHP 5.1 there is an upgrading guide -available <a href="/UPDATE_5_2.txt">here</a>, detailing the changes between those releases -and PHP 5.2.0. -</p> - -<hr /> - <p class="center"><a href="/archive/index.php">News Archive</a></p> <?php http://cvs.php.net/viewvc.cgi/phpweb/include/version.inc?r1=1.9&r2=1.10&diff_format=u Index: phpweb/include/version.inc diff -u phpweb/include/version.inc:1.9 phpweb/include/version.inc:1.10 --- phpweb/include/version.inc:1.9 Fri Apr 27 01:34:46 2007 +++ phpweb/include/version.inc Thu May 3 23:31:50 2007 @@ -17,25 +17,25 @@ */ /* PHP 5 Release */ -$PHP_5_VERSION = "5.2.1"; -$PHP_5_DATE = "08 Feb 2007"; +$PHP_5_VERSION = "5.2.2"; +$PHP_5_DATE = "03 May 2007"; $PHP_5_MD5 = array( - "tar.bz2" => "261218e3569a777dbd87c16a15f05c8d", - "tar.gz" => "604eaee2b834bb037d2c83e53e300d3f", - "zip" => "682dd66fb03c7dd24c522f474e1b04b6", - "installer" => "f0a1445f4adfdc2e00a81b2eb788be5c", - "pecl.zip" => "dc8b394146faf7effa6f26df02e8e534", - "nts.zip" => "815c8c61af58fffdc34d34c24310ffe2", - "pecl.nts" => "ffd78a31a704d68c8adadc9288261583", + "tar.bz2" => "d084337867d70b50a10322577be0e44e", + "tar.gz" => "7a920d0096900b2b962b21dc5c55fe3c", + "zip" => "634cf45c34f80dfb1284cabf1bbb1417", + "installer" => "eea060523d095ae421409e8a9c343207", + "pecl.zip" => "5d206368799dfbac983d83954328ae3a", + "nts.zip" => "b9abde6658b91ab66acb26eca699b5f6", + "pecl.nts" => "902360747287abaf4c8906efb609f2f8", ); /* PHP 4 Release */ -$PHP_4_VERSION = "4.4.6"; -$PHP_4_DATE = "01 Mar 2007"; +$PHP_4_VERSION = "4.4.7"; +$PHP_4_DATE = "03 May 2007"; $PHP_4_MD5 = array( - "tar.bz2" => "5db283824310c87efb18c76b4735c4bd", - "tar.gz" => "07c607fcf12435f0078d72fe0de4e3c0", - "zip" => "486764cefb5f7bde39e95c49b2e38635", + "tar.bz2" => "3f21b44d37a57ca3876d3aea713c700d", + "tar.gz" => "2669d2049822ac14abb263703d24f643", + "zip" => "e774e79530d610c58c5f2da433d14e0f", ); $RELEASES = array( @@ -67,8 +67,7 @@ "filename" => "php-$PHP_5_VERSION-win32-installer.msi", "name" => "PHP $PHP_5_VERSION installer", "md5" => $PHP_5_MD5["installer"], - "date" => "12 Feb 2007", # $PHP_5_DATE, - "note" => "This file was updated February 12th to fix problems when upgrading from previous PHP versions.", + "date" => $PHP_5_DATE, ), array( "filename" => "pecl-$PHP_5_VERSION-Win32.zip", @@ -91,7 +90,7 @@ ), ), ), - "5.2.2RC2" => array(), /* Yes, it should be empty - unless we want it in the version feed? */ +// "5.2.3" => array(), /* Yes, it should be empty - unless we want it in the version feed? */ ), 4 => array( $PHP_4_VERSION => array( @@ -120,7 +119,7 @@ ), ), ), - "4.4.7RC1" => array(), /* Yes, it should be empty.. unless we want it in the version feed..? */ +// "4.4.7RC1" => array(), /* Yes, it should be empty.. unless we want it in the version feed..? */ ), ); http://cvs.php.net/viewvc.cgi/phpweb/releases/index.php?r1=1.9&r2=1.10&diff_format=u Index: phpweb/releases/index.php diff -u phpweb/releases/index.php:1.9 phpweb/releases/index.php:1.10 --- phpweb/releases/index.php:1.9 Thu May 3 18:27:31 2007 +++ phpweb/releases/index.php Thu May 3 23:31:50 2007 @@ -1,5 +1,5 @@ <?php -// $Id: index.php,v 1.9 2007/05/03 18:27:31 bjori Exp $ +// $Id: index.php,v 1.10 2007/05/03 23:31:50 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/index.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; @@ -80,6 +80,7 @@ <option value="php-4.4.3.tar.gz">4.4.3</option> <option value="php-4.4.4.tar.gz">4.4.4</option> <option value="php-4.4.5.tar.gz">4.4.5</option> + <option value="php-4.4.6.tar.gz">4.4.6</option> <option value="">--------</option> <option value="php-5.0.0.tar.gz">5.0.0</option> <option value="php-5.0.1.tar.gz">5.0.1</option> @@ -95,6 +96,7 @@ <option value="php-5.1.5.tar.gz">5.1.5</option> <option value="php-5.1.6.tar.gz">5.1.6</option> <option value="php-5.2.0.tar.gz">5.2.0</option> + <option value="php-5.2.1.tar.gz">5.2.1</option> </select> </p> </form> @@ -114,6 +116,38 @@ </p> <a name="v5"></a> +<a name="5.2.1"></a> +<h2>5.2.1</h2> + +<ul> + <li>Released: 08 Feb 2007</li> + <li>Announcement: <a href="/releases/5_2_1.php">English</a></li> + <li><a href="/ChangeLog-5.php#5.2.1">ChangeLog</a></li> + <li> + Download: + <ul> + <li> + <?php download_link('php-5.2.1.tar.bz2','Source (tar.bz2)'); ?><br /> + <span class="md5sum">md5: 261218e3569a777dbd87c16a15f05c8d</span> + </li> + <li> + <?php download_link('php-5.2.1.tar.gz','Source (tar.gz)'); ?><br /> + <span class="md5sum">md5: 604eaee2b834bb037d2c83e53e300d3f</span> + </li> + <li> + <?php download_link('php-5.2.1-Win32.zip','Windows binary'); ?><br /> + <span class="md5sum">md5: 682dd66fb03c7dd24c522f474e1b04b6</span> + </li> + <li> + <?php download_link('pecl-5.2.1-Win32.zip','Collection of PECL modules for PHP 5.2.1'); ?><br /> + <span class="md5sum">md5: dc8b394146faf7effa6f26df02e8e534</span> + </li> + </ul> + </li> +</ul> + + +<a name="v5"></a> <a name="5.2.0"></a> <h2>5.2.0</h2> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_4_7.php?view=markup&rev=1.1 Index: phpweb/releases/4_4_7.php +++ phpweb/releases/4_4_7.php <?php // $Id: 4_4_7.php,v 1.1 2007/05/03 23:31:50 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_4_7.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.4.7 Release Announcement"); ?> <h1>PHP 4.4.7 Release Announcement</h1> <p> The PHP development team would like to announce the immediate availability of PHP 4.4.7. This release continues to improve the security and the stability of the 4.4 branch and all users are strongly encouraged to upgrade to it as soon as possible. </p> <p> <b>Security Enhancements and Fixes in PHP 4.4.7:</b> </p> <ul> <li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)</li> <li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)</li> <li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)</li> <li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)</li> <li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)</li> <li>Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser).</li> <li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)</li> <li>XSS in phpinfo() (MOPB-8 by Stefan Esser)</li> <li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)</li> <li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser)</li> <li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)</li> </ul> <p> While majority of the issues outlined above are local, few issues such as the XML-RPC overflows can be triggered remotely and therefor should be considered critical. If you use the XML-RPC extension consider upgrading as soon as possible. </p> <p> <b>Other improvements of PHP 4.4.7 include:</b> </p> <ul> <li>About 10 bug fixes.</li> </ul> <p> For a full list of changes in PHP 4.4.7, see the <a href="/ChangeLog-4.php#4.4.7">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_2_2.php?view=markup&rev=1.1 Index: phpweb/releases/5_2_2.php +++ phpweb/releases/5_2_2.php <?php // $Id: 5_2_2.php,v 1.1 2007/05/03 23:31:50 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_2_2.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.2.2 Release Announcement"); ?> <h1>PHP 5.2.2 Release Announcement</h1> <p> The PHP development team would like to announce the immediate availability of PHP 5.2.2. This release continues to improve the security and the stability of the 5.X branch and all users are strongly encouraged to upgrade to it as soon as possible. </p> <p> <b>Security Enhancements and Fixes in PHP 5.2.2:</b> </p> <ul> <li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)</li> <li>Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser)</li> <li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)</li> <li>Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser)</li> <li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)</li> <li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)</li> <li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)</li> <li>Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-20, MOPB-21 by Stefan Esser).</li> <li>Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)</li> <li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)</li> <li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)</li> <li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Steffan Esser)</li> <li>Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (by Ilia Alshanetsky)</li> <li>Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia Alshanetsky)</li> <li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)</li> </ul> <p> While majority of the issues outlined above are local, in some circumstances given specific code paths they can be triggered externally. Therefor, we strongly recommend that if you use code utilizing the functions and extensions identified as having had vulnerabilities in them, you consider upgrading your PHP. </p> <p> <b>The key improvements of PHP 5.2.2 include:</b> </p> <ul> <li>Further improvements to the Memory Manager with the goal of improving realloc() performance.</li> <li>Bundled GD, SQLite and PCRE libraries were upgraded.</li> <li>Additional methods were added to SPL's DirectoryIterator and SplFileInfo classes.</li> <li>Over 120 bug fixes.</li> </ul> <p> For users upgrading from PHP 5.0 and PHP 5.1, an upgrade guide is available <a href="/UPDATE_5_2.txt">here</a>, detailing the changes between those releases and PHP 5.2.2. </p> <p> For a full list of changes in PHP 5.2.2, see the <a href="/ChangeLog-5.php#5.2.2">ChangeLog</a>. </p> <?php site_footer(); ?>