cvs: phpweb / ChangeLog-5.php /archive 2007.xml /include version.inc /releases 5_2_4.php index.php
| From: | Ilia Alshanetsky | Date: | Thu, 30 Aug 2007 23:36:27 +0000 |
| Subject: | cvs: phpweb / ChangeLog-5.php /archive 2007.xml /include version.inc /releases 5_2_4.php index.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-36330@lists.php.net to get a copy of this message | ||
iliaa Thu Aug 30 23:36:27 2007 UTC
Added files:
/phpweb/releases 5_2_4.php
Modified files:
/phpweb ChangeLog-5.php
/phpweb/archive 2007.xml
/phpweb/include version.inc
/phpweb/releases index.php
Log:
5.2.4
http://cvs.php.net/viewvc.cgi/phpweb/ChangeLog-5.php?r1=1.47&r2=1.48&diff_format=u Index: phpweb/ChangeLog-5.php diff -u phpweb/ChangeLog-5.php:1.47 phpweb/ChangeLog-5.php:1.48 --- phpweb/ChangeLog-5.php:1.47 Thu May 31 22:57:31 2007 +++ phpweb/ChangeLog-5.php Thu Aug 30 23:36:27 2007 @@ -1,5 +1,5 @@ <?php -// $Id: ChangeLog-5.php,v 1.47 2007/05/31 22:57:31 iliaa Exp $ +// $Id: ChangeLog-5.php,v 1.48 2007/08/30 23:36:27 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'ChangeLog-5.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5 ChangeLog"); @@ -11,6 +11,178 @@ <hr /> +<a name="5.2.4"></a> +<h3>Version 5.2.4</h3> +<b>30-August-2007</b> +<ul> +<li>Security Fixes + <ul> + <li>Fixed "Floating point exception" inside wordwrap(). (Mattias Bengtsson, Ilia) + <li>Fixed several integer overflows in ImageCreate(), ImageCreateTrueColor(), ImageCopyResampled() and ImageFilledPolygon() reported by Mattias Bengtsson. (Tony) + <li>Fixed size calculation in chunk_split(). (Stas) + <li>Fixed integer overflow in str[c]spn(). (Stas) + <li>Fixed money_format() not to accept multiple %i or %n tokens. (Stas, Ilia) + <li>Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Ilia) + <li>Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Stas) + <li>Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Stas, Maksymilian Arciemowicz) + <li>Fixed possible invalid read in glob() win32 implementation (CVE-2007-3806). (Tony) + <li>Improved fix for MOPB-03-2007. (Ilia) + <li>Corrected fix for CVE-2007-2872. (Ilia) + </ul> +</li> + +<li>Removed --enable-versioning configure option. (Jani)</li> + +<li>Upgraded PCRE to version 7.2 (Nuno)</li> +<li>Updated timezone database to version 2007.6. (Derick)</li> + +<li>Improved openssl_x509_parse() to return extensions in readable form. (Dmitry)</li> + +<li>Enabled changing the size of statement cache for non-persistent OCI8 connections. (Chris Jones, Tony)</li> + +<li>Changed display_errors php.ini option to accept stderr as value which makes the error messages to be outputted to STDERR instead of STDOUT with CGI and CLI SAPIs (<?php bugl(22839); ?>). (Jani)</li> +<li>Changed error handler to send HTTP 500 instead of blank page on PHP errors. (Dmitry, Andrei Nigmatulin)</li> +<li>Changed mail() function to be always available. (Johannes)</li> + +<li>Added check for unknown options passed to configure. (Jani)</li> +<li>Added persistent connection status checker to pdo_pgsql. (Elvis Pranskevichus, Ilia)</li> +<li>Added support for ATTR_TIMEOUT inside pdo_pgsql driver. (Ilia)</li> +<li>Added php_ini_loaded_file() function which returns the path to the actual php.ini in use. (Jani)</li> +<li>Added GD version constants GD_MAJOR_VERSION, GD_MINOR_VERSION GD_RELEASE_VERSION, GD_EXTRA_VERSION and GD_VERSION_STRING. (Pierre)</li> +<li>Added missing open_basedir checks to CGI. (anight at eyelinkmedia dot com, Tony)</li> +<li>Added missing format validator to unpack() function. (Ilia)</li> +<li>Added missing error check inside bcpowmod(). (Ilia)</li> +<li>Added CURLOPT_PRIVATE & CURLINFO_PRIVATE constants. (Andrey A. Belashkov, Tony)</li> +<li>Added missing MSG_EOR and MSG_EOF constants to sockets extension. (Jani)</li> +<li>Added PCRE_VERSION constant. (Tony)</li> +<li>Added ReflectionExtension::info() function to print the phpinfo() block for an extension. (Johannes)</li> + +<li>Implemented FR <?php bugl(41884); ?> (ReflectionClass::getDefaultProperties() does not handle static attributes). (Tony)</li> + +<li>Fixed possible crash in imagepsloadfont(), work around a bug in the pslib on Windows. (Pierre)</li> +<li>Fixed oci8 and PDO_OCI extensions to allow configuring with Oracle 11g client libraries. (Chris Jones)</li> +<li>Fixed EOF handling in case of reading from file opened in write only mode. (Dmitry)</li> +<li>Fixed var_export() to use the new H modifier so that it can generate parseable PHP code for floats, independent of the locale. (Derick)</li> +<li>Fixed regression introduced by the fix for the libgd bug #74. (Pierre)</li> +<li>Fixed SimpleXML's behavior when used with empty(). (Sara)</li> +<li>Fixed crash in OpenSSL extension because of non-string passphrase. (Dmitry)</li> + +<li>Fixed PECL Bug #11345 (PDO_OCI crash after National language Support "NLS" environment initialization error). (Chris Jones)</li> +<li>Fixed PECL bug #11216 (crash in ZipArchive::addEmptyDir when a directory already exists). (Pierre)</li> + +<li><?php bugfix(42368); ?> (Incorrect error message displayed by pg_escape_string). (Ilia)</li> +<li><?php bugfix(42365); ?> (glob() crashes and/or accepts way too many flags). (Jani)</li> +<li><?php bugfix(42364); ?> (Crash when using getRealPath with DirectoryIterator). (Johannes)</li> +<li><?php bugfix(42292); ?> ($PHP_CONFIG not set for phpized builds). (Jani)</li> +<li><?php bugfix(42261); ?> (header wrong for date field). (roberto at spadim dot com dot br, Ilia)</li> +<li><?php bugfix(42259); ?> (SimpleXMLIterator loses ancestry). (Rob)</li> +<li><?php bugfix(42247); ?> (ldap_parse_result() not defined under win32). (Jani)</li> +<li><?php bugfix(42243); ?> (copy() does not output an error when the first arg is a dir). (Ilia)</li> +<li><?php bugfix(42242); ?> (sybase_connect() crashes). (Ilia)</li> +<li><?php bugfix(42237); ?> (stream_copy_to_stream returns invalid values for mmaped streams). (andrew dot minerd at sellingsource dot com, Ilia)</li> +<li><?php bugfix(42233); ?> (Problems with æøå in extract()). (Jani)</li> +<li><?php bugfix(42222); ?> (possible buffer overflow in php_openssl_make_REQ). (Pierre)</li> +<li><?php bugfix(42211); ?> (property_exists() fails to find protected properties from a parent class). (Dmitry)</li> +<li><?php bugfix(42208); ?> (substr_replace() crashes when the same array is passed more than once). (crrodriguez at suse dot de, Ilia)</li> +<li><?php bugfix(42198); ?> (SCRIPT_NAME and PHP_SELF truncated when inside a userdir and using PATH_INFO). (Dmitry)</li> +<li><?php bugfix(42195); ?> (C++ compiler required always). (Jani)</li> +<li><?php bugfix(42183); ?> (classmap causes crash in non-wsdl mode). (Dmitry)</li> +<li><?php bugfix(42173); ?> (oci8 INTERVAL and TIMESTAMP type fixes). (Chris)</li> +<li><?php bugfix(42151); ?> (__destruct functions not called after catching a SoapFault exception). (Dmitry)</li> +<li><?php bugfix(42142); ?> (substr_replace() returns FALSE when length > string length). (Ilia) </li> +<li><?php bugfix(42135); ?> (Second call of session_start() causes creation of SID). (Ilia)</li> +<li><?php bugfix(42134); ?> (oci_error() returns false after oci_new_collection() fails). (Tony)</li> +<li><?php bugfix(42119); ?> (array_push($arr,&$obj) doesn't work with zend.ze1_compatibility_mode On). (Dmitry)</li> +<li><?php bugfix(42117); ?> (bzip2.compress loses data in internal buffer). (Philip, Ilia)</li> +<li><?php bugfix(42112); ?> (deleting a node produces memory corruption). (Rob)</li> +<li><?php bugfix(42107); ?> (sscanf broken when using %2$s format parameters). (Jani)</li> +<li><?php bugfix(42090); ?> (json_decode causes segmentation fault). (Hannes)</li> +<li><?php bugfix(42082); ?> (NodeList length zero should be empty). (Hannes)</li> +<li><?php bugfix(42072); ?> (No warning message for clearstatcache() with arguments). (Ilia)</li> +<li><?php bugfix(42071); ?> (ini scanner allows using NULL as option name). (Jani)</li> +<li><?php bugfix(42027); ?> (is_file() / is_dir() matches file/dirnames with wildcard char or trailing slash in Windows). (Dmitry)</li> +<li><?php bugfix(42019); ?> (configure option --with-adabas=DIR does not work). (Jani)</li> +<li><?php bugfix(42015); ?> (ldap_rename(): server error "DSA is unwilling to perform"). (bob at mroczka dot com, Jani)</li> +<li><?php bugfix(42009); ?> (is_a() and is_subclass_of() should NOT call autoload, in the same way as "instanceof" operator). (Dmitry)</li> +<li><?php bugfix(41989); ?> (move_uploaded_file() & relative path in ZTS mode). (Tony)</li> +<li><?php bugfix(41984); ?> (Hangs on large SoapClient requests). (Dmitry)</li> +<li><?php bugfix(41983); ?> (Error Fetching http headers terminated by '\n'). (Dmitry)</li> +<li><?php bugfix(41973); ?> (--with-ldap=shared fails with LDFLAGS="-Wl,--as-needed"). (Nuno)</li> +<li><?php bugfix(41971); ?> (PDOStatement::fetch and PDOStatement::setFetchMode causes unexpected behavior). (Ilia)</li> +<li><?php bugfix(41964); ?> (strtotime returns a timestamp for non-time string of pattern '(A|a) .+'). (Derick)</li> +<li><?php bugfix(41961); ?> (Ensure search for hidden private methods does not stray from class hierarchy). (robin_fernandes at uk dot ibm dot com)</li> +<li><?php bugfix(41947); ?> (SimpleXML incorrectly registers empty strings as namespaces). (Rob)</li> +<li><?php bugfix(41929); ?> (Foreach on object does not iterate over all visible properties). (Dmitry)</li> +<li><?php bugfix(41919); ?> (crash in string to array conversion). (judas dot iscariote at gmail dot com, Ilia)</li> +<li><?php bugfix(41909); ?> (var_export() is locale sensitive when exporting float values). (Derick)</li> +<li><?php bugfix(41908); ?> (CFLAGS="-Os" ./configure --enable-debug fails). (christian at hoffie dot info, Tony) </li> +<li><?php bugfix(41904); ?> (proc_open(): empty env array should cause empty environment to be passed to process). (Jani)</li> +<li><?php bugfix(41867); ?> (SimpleXML: getName is broken). (Rob)</li> +<li><?php bugfix(41865); ?> (fputcsv(): 2nd parameter is not optional). (Jani)</li> +<li><?php bugfix(41861); ?> (SimpleXML: getNamespaces() returns the namespaces of a node's siblings). (Rob)</li> +<li><?php bugfix(41845); ?> (pgsql extension does not compile with PostgreSQL <7.4). (Ilia)</li> +<li><?php bugfix(41844); ?> (Format returns incorrect number of digits for negative years -0001 to -0999). (Derick)</li> +<li><?php bugfix(41842); ?> (Cannot create years < 0100 & negative years with date_create or new DateTime). (Derick)</li> +<li><?php bugfix(41833); ?> (addChild() on a non-existent node, no node created, getName() segfaults). (Rob)</li> +<li><?php bugfix(41831); ?> (pdo_sqlite prepared statements convert resources to strings). (Ilia)</li> +<li><?php bugfix(41815); ?> (Concurrent read/write fails when EOF is reached). (Sascha)</li> +<li><?php bugfix(41813); ?> (segmentation fault when using string offset as an object). (judas dot iscariote at gmail dot com, Tony)</li> +<li><?php bugfix(41795); ?> (checkdnsrr does not support DNS_TXT type). (lucas at facebook dot com, Tony)</li> +<li><?php bugfix(41773); ?> (php_strip_whitespace() sends headers with errors suppressed). (Tony)</li> +<li><?php bugfix(41770); ?> (SSL: fatal protocol error due to buffer issues). (Ilia)</li> +<li><?php bugfix(41765); ?> (Recode crashes/does not work on amd64). (nexus at smoula dot net, Stas)</li> +<li><?php bugfix(41724); ?> (libxml_get_last_error() - errors service request scope). (thekid at php dot net, Ilia)</li> +<li><?php bugfix(41717); ?> (imagepolygon does not respect thickness). (Pierre)</li> +<li><?php bugfix(41713); ?> (Persistent memory consumption on win32 since 5.2). (Dmitry)</li> +<li><?php bugfix(41711); ?> (NULL temporary lobs not supported in OCI8). (Chris Jones, Tony)</li> +<li><?php bugfix(41709); ?> (strtotime() does not handle 00.00.0000). (Derick)</li> +<li><?php bugfix(41698); ?> (float parameters truncated to integer in prepared statements). (Ilia)</li> +<li><?php bugfix(41692); ?> (ArrayObject shows weird behavior in respect to inheritance). (Tony)</li> +<li><?php bugfix(41691); ?> (ArrayObject::exchangeArray hangs Apache). (Tony)</li> +<li><?php bugfix(41686); ?> (Omitting length param in array_slice not possible). (Ilia)</li> +<li><?php bugfix(41685); ?> (array_push() fails to warn when next index is already occupied). (Ilia)</li> +<li><?php bugfix(41655); ?> (open_basedir bypass via glob()). (Ilia)</li> +<li><?php bugfix(41640); ?> (get_class_vars produces error on class constants). (Johannes)</li> +<li><?php bugfix(41635); ?> (SoapServer and zlib.output_compression with FastCGI result in major slowdown). (Dmitry)</li> +<li><?php bugfix(41633); ?> (Crash instantiating classes with self-referencing constants). (Dmitry)</li> +<li><?php bugfix(41630); ?> (segfault when an invalid color index is present in the image data). (Reported by Elliot wccoder@gmail dot com) (Pierre)</li> +<li><?php bugfix(41628); ?> (PHP settings leak between Virtual Hosts in Apache 1.3). (Scott, manuel at mausz dot at)</li> +<li><?php bugfix(41608); ?> (segfault on a weird code with objects and switch()). (Tony)</li> +<li><?php bugfix(41600); ?> (url rewriter tags doesn't work with namespaced tags). (Ilia)</li> +<li><?php bugfix(41596); ?> (Fixed a crash inside pdo_pgsql on some non-well-formed SQL queries). (Ilia)</li> +<li><?php bugfix(41594); ?> (OCI8 statement cache is flushed too frequently). (Tony)</li> +<li><?php bugfix(41582); ?> (SimpleXML crashes when accessing newly created element). (Tony)</li> +<li><?php bugfix(41576); ?> (configure failure when using --without-apxs or some other SAPIs disabling options). (Jani)</li> +<li><?php bugfix(41567); ?> (json_encode() double conversion is inconsistent with PHP). (Lucas, Ilia)</li> +<li><?php bugfix(41566); ?> (SOAP Server not properly generating href attributes). (Dmitry)</li> +<li><?php bugfix(41555); ?> (configure failure: regression caused by fix for #41265). (Jani)</li> +<li><?php bugfix(41527); ?> (WDDX deserialize numeric string array key). (Matt, Ilia)</li> +<li><?php bugfix(41523); ?> (strtotime('0000-00-00 00:00:00') is parsed as 1999-11-30). (Derick)</li> +<li><?php bugfix(41518); ?> (file_exists() warns of open_basedir restriction on non-existent file). (Tony)</li> +<li><?php bugfix(41445); ?> (parse_ini_file() has a problem with certain types of integer as sections). (Tony)</li> +<li><?php bugfix(41433); ?> (DBA: configure fails to include correct db.h for db4). (Jani)</li> +<li><?php bugfix(41372); ?> (Internal pointer of source array resets during array copying). (Dmitry)</li> +<li><?php bugfix(41350); ?> (my_thread_global_end() error during request shutdown on Windows). (Scott, Andrey)</li> +<li><?php bugfix(41278); ?> (get_loaded_extensions() should list Zend extensions). (Johannes)</li> +<li><?php bugfix(41127); ?> (Memory leak in ldap_{first|next}_attribute functions). (Jani)</li> +<li><?php bugfix(40757); ?> (get_object_vars get nothing in child class). (Dmitry)</li> +<li><?php bugfix(40705); ?> (Iterating within function moves original array pointer). (Dmitry)</li> +<li><?php bugfix(40509); ?> (key() function changed behaviour if global array is used within function). (Dmitry)</li> +<li><?php bugfix(40419); ?> (Trailing slash in CGI request does not work). (Dmitry)</li> +<li><?php bugfix(39330); ?> (apache2handler does not call shutdown actions before apache child die). (isk at ecommerce dot com, Gopal, Tony)</li> +<li><?php bugfix(39291); ?> (ldap_sasl_bind() misses the sasl_authc_id parameter). (diafour at gmail dot com, Jani)</li> +<li><?php bugfix(37715); ?> (array pointers resetting on copy). (Dmitry)</li> +<li><?php bugfix(37273); ?> (Symlinks and mod_files session handler allow open_basedir bypass). (Ilia)</li> +<li><?php bugfix(36492); ?> (Userfilters can leak buckets). (Sara)</li> +<li>Fixed bugs <?php bugl(36796); ?>, <?php bugl(36918); ?>, <?php bugl(41371); ?> (stream_set_blocking() does not work). (Jani)</li> +<li><?php bugfix(35981); ?> (pdo-pgsql should not use pkg-config when not present). (Jani)</li> +<li><?php bugfix(31892); ?> (PHP_SELF incorrect without cgi.fix_pathinfo, but turning on screws up PATH_INFO). (Dmitry)</li> +<li><?php bugfix(21197); ?> (socket_read() outputs error with PHP_NORMAL_READ). (Nuno, Jani) + +</ul> + +<hr /> + <a name="5.2.3"></a> <h3>Version 5.2.3</h3> <b>31-May-2007</b> http://cvs.php.net/viewvc.cgi/phpweb/archive/2007.xml?r1=1.12&r2=1.13&diff_format=u Index: phpweb/archive/2007.xml diff -u phpweb/archive/2007.xml:1.12 phpweb/archive/2007.xml:1.13 --- phpweb/archive/2007.xml:1.12 Mon Jul 16 16:43:14 2007 +++ phpweb/archive/2007.xml Thu Aug 30 23:36:27 2007 @@ -1,4 +1,4 @@ -<?xml version="1.0" encoding="utf-8"?> +\<?xml version="1.0" encoding="utf-8"?> <feed xmlns="http://www.w3.org/2005/Atom" xml:base="/" xmlns:php="http://php.net/ns/news"> <title>PHP.net news & announcements</title> <link href="/feed.atom" rel="self"/> @@ -10,6 +10,62 @@ <uri>http://php.net/contact</uri> <email>webmaster@php.net</email> </author> + + <entry xmlns="http://www.w3.org/2005/Atom"> + <title>PHP 5.2.4 Released</title> + <link href="/index.php#2007-08-30-1" rel="alternate" type="text/html"/> + <link href="/archive/2007.php#2007-08-30-1" rel="via" type="text/html"/> + <id>http://php.net/archive/2007.php#2007-08-30-1</id> + <published>2007-08-30T20:00:00+04:00</published> + <updated>2007-08-30T20:00:00+04:00</updated> + <category term="frontpage" label="PHP.net frontpage news"/> + <category term="releases" label="New PHP release"/> + <content type="xhtml"> + <div xmlns="http://www.w3.org/1999/xhtml"> +<p> +The PHP development team would like to announce the immediate +<a href="/downloads.php#v5">availability of PHP 5.2.4</a>. +This release focuses on improving the stability of the PHP 5.2.X +branch with over 120 various bug fixes in addition to resolving +several low priority security bugs. All users of PHP are encouraged +to upgrade to this release. +</p> + +<p> +Further details about the PHP 5.2.4 release can be found in the +<a href="/releases/5_2_4.php">release announcement for 5.2.4</a>, the full list of +changes is available in the <a href="/ChangeLog-5.php#5.2.4">ChangeLog for PHP 5</a>. +</p> + +<p> +<b>Security Enhancements and Fixes in PHP 5.2.4:</b> +</p> +<ul> + <li>Fixed a floating point exception inside wordwrap() (Reported by Mattias Bengtsson)</li> + <li>Fixed several integer overflows inside the GD extension (Reported by Mattias Bengtsson)</li> + <li>Fixed size calculation in chunk_split() (Reported by Gerhard Wagner)</li> + <li>Fixed integer overflow in str[c]spn(). (Reported by Stanislav Malyshev)</li> + <li>Fixed money_format() not to accept multiple %i or %n tokens. (Reported by Stanislav Malyshev)</li> + <li>Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Reported by Stefan Esser)</li> + <li>Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Reported by Stanislav Malyshev)</li> + <li>Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Reported by Maksymilian Arciemowicz)</li> + <li>Fixed a possible invalid read in glob() win32 implementation (CVE-2007-3806) (Reported by shinnai)</li> + <li>Fixed a possible buffer overflow in php_openssl_make_REQ (Reported by zatanzlatan at hotbrev dot com)</li> + <li>Fixed an open_basedir bypass inside glob() function (Reported by dr at peytz dot dk)</li> + <li>Fixed a possible open_basedir bypass inside session extension when the session file is a symlink (Reported by c dot i dot morris at durham dot ac dot uk)</li> + <li>Improved fix for MOPB-03-2007.</li> + <li>Corrected fix for CVE-2007-2872.</li> +</ul> + +<p> +For users upgrading to PHP 5.2 from PHP 5.0 and PHP 5.1, an upgrade guide is +available <a href="/migration52">here</a>, detailing the changes between +those releases and PHP 5.2.4. +</p> + </div> + </content> + </entry> + <entry xmlns="http://www.w3.org/2005/Atom"> <title>php|works 2007 in Atlanta</title> <link href="/conferences/index.php#2007-07-16-01" rel="alternate" type="text/html"/> http://cvs.php.net/viewvc.cgi/phpweb/include/version.inc?r1=1.16&r2=1.17&diff_format=u Index: phpweb/include/version.inc diff -u phpweb/include/version.inc:1.16 phpweb/include/version.inc:1.17 --- phpweb/include/version.inc:1.16 Thu Aug 23 22:59:13 2007 +++ phpweb/include/version.inc Thu Aug 30 23:36:27 2007 @@ -17,18 +17,18 @@ */ /* PHP 5 Release */ -$PHP_5_VERSION = "5.2.3"; -$PHP_5_DATE = "01 June 2007"; +$PHP_5_VERSION = "5.2.4"; +$PHP_5_DATE = "30 August 2007"; $PHP_5_MD5 = array( - "tar.bz2" => "eb50b751c8e1ced05bd012d5a0e4dec3", - "tar.gz" => "df79b04d63fc4c1ccb6d8ea58a9cf3ac", - "zip" => "ff6e5dc212823009e68f26d66d85cbac", - "installer" => "4d042f649d9c264477e1b421c64c6435", - "pecl.zip" => "0480ffaf5a5333e83d90d75cece54748", - "nts.zip" => "3b291d4081af3100b83e39b8aacc444a", - "pecl.nts" => "ddf283dc8a9c49c8d2c5f38ad697c051", + "tar.bz2" => "55c97a671fdabf462cc7a82971a656d2", + "tar.gz" => "0826e231c3148b29fd039d7a8c893ad3", + "zip" => "979b8a305b028b296b97ed72322026b2", + "installer" => "ad23dcc391a8c26c7d387eb5e9bf1ffb", + "pecl.zip" => "dd98dfe607ceb98e727c394d5bd679fb", + "nts.zip" => "7728b869cfe3b8b7f1751da0a298fc12", + "pecl.nts" => "44302972cffd2b9cf05cb7131b56056a", ); -$PHP_5_RC = "5.2.4RC3"; +$PHP_5_RC = false; /* PHP 4 Release */ $PHP_4_VERSION = "4.4.7"; http://cvs.php.net/viewvc.cgi/phpweb/releases/index.php?r1=1.13&r2=1.14&diff_format=u Index: phpweb/releases/index.php diff -u phpweb/releases/index.php:1.13 phpweb/releases/index.php:1.14 --- phpweb/releases/index.php:1.13 Fri Jul 13 07:11:47 2007 +++ phpweb/releases/index.php Thu Aug 30 23:36:27 2007 @@ -1,5 +1,5 @@ <?php -// $Id: index.php,v 1.13 2007/07/13 07:11:47 derick Exp $ +// $Id: index.php,v 1.14 2007/08/30 23:36:27 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/index.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; @@ -97,7 +97,8 @@ <option value="php-5.1.6.tar.gz">5.1.6</option> <option value="php-5.2.0.tar.gz">5.2.0</option> <option value="php-5.2.1.tar.gz">5.2.1</option> - <option value="php-5.2.2.tar.gz">5.2.1</option> + <option value="php-5.2.2.tar.gz">5.2.2</option> + <option value="php-5.2.3.tar.gz">5.2.3</option> </select> </p> </form> @@ -117,6 +118,38 @@ </p> <a name="v5"></a> +<a name="5.2.3"></a> +<h2>5.2.3</h2> + +<ul> + <li>Released: 31 May 2007</li> + <li>Announcement: <a href="/releases/5_2_3.php">English</a></li> + <li><a href="/ChangeLog-5.php#5.2.3">ChangeLog</a></li> + <li> + Download: + <ul> + <li> + <?php download_link('php-5.2.3.tar.bz2','Source (tar.bz2)'); ?><br /> + <span class="md5sum">md5: eb50b751c8e1ced05bd012d5a0e4dec3</span> + </li> + <li> + <?php download_link('php-5.2.3.tar.gz','Source (tar.gz)'); ?><br /> + <span class="md5sum">md5: df79b04d63fc4c1ccb6d8ea58a9cf3ac</span> + </li> + <li> + <?php download_link('php-5.2.3-Win32.zip','Windows binary'); ?><br /> + <span class="md5sum">md5: ff6e5dc212823009e68f26d66d85cbac</span> + </li> + <li> + <?php download_link('pecl-5.2.3-Win32.zip','Collection of PECL modules for PHP 5.2.3'); ?><br /> + <span class="md5sum">md5: 0480ffaf5a5333e83d90d75cece54748</span> + </li> + </ul> + </li> +</ul> + + +<a name="v5"></a> <a name="5.2.2"></a> <h2>5.2.2</h2> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_2_4.php?view=markup&rev=1.1 Index: phpweb/releases/5_2_4.php +++ phpweb/releases/5_2_4.php <?php // $Id: 5_2_4.php,v 1.1 2007/08/30 23:36:27 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_2_4.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.2.4 Release Announcement"); ?> <h1>PHP 5.2.4 Release Announcement</h1> <p> The PHP development team would like to announce the immediate availability of PHP 5.2.4. This release focuses on improving the stability of the PHP 5.2.X branch with over 120 various bug fixes in addition to resolving several low priority security bugs. All users of PHP are encouraged to upgrade to this release. </p> <p> <b>Security Enhancements and Fixes in PHP 5.2.4:</b> </p> <ul> <li>Fixed a floating point exception inside wordwrap() (Reported by Mattias Bengtsson)</li> <li>Fixed several integer overflows inside the GD extension (Reported by Mattias Bengtsson)</li> <li>Fixed size calculation in chunk_split() (Reported by Gerhard Wagner)</li> <li>Fixed integer overflow in str[c]spn(). (Reported by Stanislav Malyshev)</li> <li>Fixed money_format() not to accept multiple %i or %n tokens. (Reported by Stanislav Malyshev)</li> <li>Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Reported by Stefan Esser)</li> <li>Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Reported by Stanislav Malyshev)</li> <li>Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Reported by Maksymilian Arciemowicz)</li> <li>Fixed a possible invalid read in glob() win32 implementation (CVE-2007-3806) (Reported by shinnai)</li> <li>Fixed a possible buffer overflow in php_openssl_make_REQ (Reported by zatanzlatan at hotbrev dot com)</li> <li>Fixed an open_basedir bypass inside glob() function (Reported by dr at peytz dot dk)</li> <li>Fixed a possible open_basedir bypass inside session extension when the session file is a symlink (Reported by c dot i dot morris at durham dot ac dot uk)</li> <li>Improved fix for MOPB-03-2007.</li> <li>Corrected fix for CVE-2007-2872.</li> </ul> <p> <b>Key enhancements in PHP 5.2.4 include:</b> </p> <ul> <li>Upgraded PCRE to version 7.2</li> <li>Added persistent connection status checker to pdo_pgsql.</li> <li>Fixed oci8 and PDO_OCI extensions to allow configuring with Oracle 11g client libraries.</li> <li>Fixed bug #41831 (pdo_sqlite prepared statements convert resources to strings).</li> <li>Fixed bug #41770 (SSL: fatal protocol error due to buffer issues)</li> <li>Fixed bug #41713 (Persistent memory consumption on win32 since 5.2)</li> <li>Over 120 bug fixes.</li> </ul> <p> For users upgrading from PHP 5.0 and PHP 5.1, an upgrade guide is available <a href="/UPDATE_5_2.txt">here</a>, detailing the changes between those releases and PHP 5.2.4. </p> <p> For a full list of changes in PHP 5.2.4, see the <a href="/ChangeLog-5.php#5.2.4">ChangeLog</a>. </p> <?php site_footer(); ?>
http://cvs.php.net/viewvc.cgi/phpweb/ChangeLog-5.php?r1=1.47&r2=1.48&diff_format=u Index: phpweb/ChangeLog-5.php diff -u phpweb/ChangeLog-5.php:1.47 phpweb/ChangeLog-5.php:1.48 --- phpweb/ChangeLog-5.php:1.47 Thu May 31 22:57:31 2007 +++ phpweb/ChangeLog-5.php Thu Aug 30 23:36:27 2007 @@ -1,5 +1,5 @@ <?php -// $Id: ChangeLog-5.php,v 1.47 2007/05/31 22:57:31 iliaa Exp $ +// $Id: ChangeLog-5.php,v 1.48 2007/08/30 23:36:27 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'ChangeLog-5.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5 ChangeLog"); @@ -11,6 +11,178 @@ <hr /> +<a name="5.2.4"></a> +<h3>Version 5.2.4</h3> +<b>30-August-2007</b> +<ul> +<li>Security Fixes + <ul> + <li>Fixed "Floating point exception" inside wordwrap(). (Mattias Bengtsson, Ilia) + <li>Fixed several integer overflows in ImageCreate(), ImageCreateTrueColor(), ImageCopyResampled() and ImageFilledPolygon() reported by Mattias Bengtsson. (Tony) + <li>Fixed size calculation in chunk_split(). (Stas) + <li>Fixed integer overflow in str[c]spn(). (Stas) + <li>Fixed money_format() not to accept multiple %i or %n tokens. (Stas, Ilia) + <li>Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Ilia) + <li>Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Stas) + <li>Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Stas, Maksymilian Arciemowicz) + <li>Fixed possible invalid read in glob() win32 implementation (CVE-2007-3806). (Tony) + <li>Improved fix for MOPB-03-2007. (Ilia) + <li>Corrected fix for CVE-2007-2872. (Ilia) + </ul> +</li> + +<li>Removed --enable-versioning configure option. (Jani)</li> + +<li>Upgraded PCRE to version 7.2 (Nuno)</li> +<li>Updated timezone database to version 2007.6. (Derick)</li> + +<li>Improved openssl_x509_parse() to return extensions in readable form. (Dmitry)</li> + +<li>Enabled changing the size of statement cache for non-persistent OCI8 connections. (Chris Jones, Tony)</li> + +<li>Changed display_errors php.ini option to accept stderr as value which makes the error messages to be outputted to STDERR instead of STDOUT with CGI and CLI SAPIs (<?php bugl(22839); ?>). (Jani)</li> +<li>Changed error handler to send HTTP 500 instead of blank page on PHP errors. (Dmitry, Andrei Nigmatulin)</li> +<li>Changed mail() function to be always available. (Johannes)</li> + +<li>Added check for unknown options passed to configure. (Jani)</li> +<li>Added persistent connection status checker to pdo_pgsql. (Elvis Pranskevichus, Ilia)</li> +<li>Added support for ATTR_TIMEOUT inside pdo_pgsql driver. (Ilia)</li> +<li>Added php_ini_loaded_file() function which returns the path to the actual php.ini in use. (Jani)</li> +<li>Added GD version constants GD_MAJOR_VERSION, GD_MINOR_VERSION GD_RELEASE_VERSION, GD_EXTRA_VERSION and GD_VERSION_STRING. (Pierre)</li> +<li>Added missing open_basedir checks to CGI. (anight at eyelinkmedia dot com, Tony)</li> +<li>Added missing format validator to unpack() function. (Ilia)</li> +<li>Added missing error check inside bcpowmod(). (Ilia)</li> +<li>Added CURLOPT_PRIVATE & CURLINFO_PRIVATE constants. (Andrey A. Belashkov, Tony)</li> +<li>Added missing MSG_EOR and MSG_EOF constants to sockets extension. (Jani)</li> +<li>Added PCRE_VERSION constant. (Tony)</li> +<li>Added ReflectionExtension::info() function to print the phpinfo() block for an extension. (Johannes)</li> + +<li>Implemented FR <?php bugl(41884); ?> (ReflectionClass::getDefaultProperties() does not handle static attributes). (Tony)</li> + +<li>Fixed possible crash in imagepsloadfont(), work around a bug in the pslib on Windows. (Pierre)</li> +<li>Fixed oci8 and PDO_OCI extensions to allow configuring with Oracle 11g client libraries. (Chris Jones)</li> +<li>Fixed EOF handling in case of reading from file opened in write only mode. (Dmitry)</li> +<li>Fixed var_export() to use the new H modifier so that it can generate parseable PHP code for floats, independent of the locale. (Derick)</li> +<li>Fixed regression introduced by the fix for the libgd bug #74. (Pierre)</li> +<li>Fixed SimpleXML's behavior when used with empty(). (Sara)</li> +<li>Fixed crash in OpenSSL extension because of non-string passphrase. (Dmitry)</li> + +<li>Fixed PECL Bug #11345 (PDO_OCI crash after National language Support "NLS" environment initialization error). (Chris Jones)</li> +<li>Fixed PECL bug #11216 (crash in ZipArchive::addEmptyDir when a directory already exists). (Pierre)</li> + +<li><?php bugfix(42368); ?> (Incorrect error message displayed by pg_escape_string). (Ilia)</li> +<li><?php bugfix(42365); ?> (glob() crashes and/or accepts way too many flags). (Jani)</li> +<li><?php bugfix(42364); ?> (Crash when using getRealPath with DirectoryIterator). (Johannes)</li> +<li><?php bugfix(42292); ?> ($PHP_CONFIG not set for phpized builds). (Jani)</li> +<li><?php bugfix(42261); ?> (header wrong for date field). (roberto at spadim dot com dot br, Ilia)</li> +<li><?php bugfix(42259); ?> (SimpleXMLIterator loses ancestry). (Rob)</li> +<li><?php bugfix(42247); ?> (ldap_parse_result() not defined under win32). (Jani)</li> +<li><?php bugfix(42243); ?> (copy() does not output an error when the first arg is a dir). (Ilia)</li> +<li><?php bugfix(42242); ?> (sybase_connect() crashes). (Ilia)</li> +<li><?php bugfix(42237); ?> (stream_copy_to_stream returns invalid values for mmaped streams). (andrew dot minerd at sellingsource dot com, Ilia)</li> +<li><?php bugfix(42233); ?> (Problems with æøå in extract()). (Jani)</li> +<li><?php bugfix(42222); ?> (possible buffer overflow in php_openssl_make_REQ). (Pierre)</li> +<li><?php bugfix(42211); ?> (property_exists() fails to find protected properties from a parent class). (Dmitry)</li> +<li><?php bugfix(42208); ?> (substr_replace() crashes when the same array is passed more than once). (crrodriguez at suse dot de, Ilia)</li> +<li><?php bugfix(42198); ?> (SCRIPT_NAME and PHP_SELF truncated when inside a userdir and using PATH_INFO). (Dmitry)</li> +<li><?php bugfix(42195); ?> (C++ compiler required always). (Jani)</li> +<li><?php bugfix(42183); ?> (classmap causes crash in non-wsdl mode). (Dmitry)</li> +<li><?php bugfix(42173); ?> (oci8 INTERVAL and TIMESTAMP type fixes). (Chris)</li> +<li><?php bugfix(42151); ?> (__destruct functions not called after catching a SoapFault exception). (Dmitry)</li> +<li><?php bugfix(42142); ?> (substr_replace() returns FALSE when length > string length). (Ilia) </li> +<li><?php bugfix(42135); ?> (Second call of session_start() causes creation of SID). (Ilia)</li> +<li><?php bugfix(42134); ?> (oci_error() returns false after oci_new_collection() fails). (Tony)</li> +<li><?php bugfix(42119); ?> (array_push($arr,&$obj) doesn't work with zend.ze1_compatibility_mode On). (Dmitry)</li> +<li><?php bugfix(42117); ?> (bzip2.compress loses data in internal buffer). (Philip, Ilia)</li> +<li><?php bugfix(42112); ?> (deleting a node produces memory corruption). (Rob)</li> +<li><?php bugfix(42107); ?> (sscanf broken when using %2$s format parameters). (Jani)</li> +<li><?php bugfix(42090); ?> (json_decode causes segmentation fault). (Hannes)</li> +<li><?php bugfix(42082); ?> (NodeList length zero should be empty). (Hannes)</li> +<li><?php bugfix(42072); ?> (No warning message for clearstatcache() with arguments). (Ilia)</li> +<li><?php bugfix(42071); ?> (ini scanner allows using NULL as option name). (Jani)</li> +<li><?php bugfix(42027); ?> (is_file() / is_dir() matches file/dirnames with wildcard char or trailing slash in Windows). (Dmitry)</li> +<li><?php bugfix(42019); ?> (configure option --with-adabas=DIR does not work). (Jani)</li> +<li><?php bugfix(42015); ?> (ldap_rename(): server error "DSA is unwilling to perform"). (bob at mroczka dot com, Jani)</li> +<li><?php bugfix(42009); ?> (is_a() and is_subclass_of() should NOT call autoload, in the same way as "instanceof" operator). (Dmitry)</li> +<li><?php bugfix(41989); ?> (move_uploaded_file() & relative path in ZTS mode). (Tony)</li> +<li><?php bugfix(41984); ?> (Hangs on large SoapClient requests). (Dmitry)</li> +<li><?php bugfix(41983); ?> (Error Fetching http headers terminated by '\n'). (Dmitry)</li> +<li><?php bugfix(41973); ?> (--with-ldap=shared fails with LDFLAGS="-Wl,--as-needed"). (Nuno)</li> +<li><?php bugfix(41971); ?> (PDOStatement::fetch and PDOStatement::setFetchMode causes unexpected behavior). (Ilia)</li> +<li><?php bugfix(41964); ?> (strtotime returns a timestamp for non-time string of pattern '(A|a) .+'). (Derick)</li> +<li><?php bugfix(41961); ?> (Ensure search for hidden private methods does not stray from class hierarchy). (robin_fernandes at uk dot ibm dot com)</li> +<li><?php bugfix(41947); ?> (SimpleXML incorrectly registers empty strings as namespaces). (Rob)</li> +<li><?php bugfix(41929); ?> (Foreach on object does not iterate over all visible properties). (Dmitry)</li> +<li><?php bugfix(41919); ?> (crash in string to array conversion). (judas dot iscariote at gmail dot com, Ilia)</li> +<li><?php bugfix(41909); ?> (var_export() is locale sensitive when exporting float values). (Derick)</li> +<li><?php bugfix(41908); ?> (CFLAGS="-Os" ./configure --enable-debug fails). (christian at hoffie dot info, Tony) </li> +<li><?php bugfix(41904); ?> (proc_open(): empty env array should cause empty environment to be passed to process). (Jani)</li> +<li><?php bugfix(41867); ?> (SimpleXML: getName is broken). (Rob)</li> +<li><?php bugfix(41865); ?> (fputcsv(): 2nd parameter is not optional). (Jani)</li> +<li><?php bugfix(41861); ?> (SimpleXML: getNamespaces() returns the namespaces of a node's siblings). (Rob)</li> +<li><?php bugfix(41845); ?> (pgsql extension does not compile with PostgreSQL <7.4). (Ilia)</li> +<li><?php bugfix(41844); ?> (Format returns incorrect number of digits for negative years -0001 to -0999). (Derick)</li> +<li><?php bugfix(41842); ?> (Cannot create years < 0100 & negative years with date_create or new DateTime). (Derick)</li> +<li><?php bugfix(41833); ?> (addChild() on a non-existent node, no node created, getName() segfaults). (Rob)</li> +<li><?php bugfix(41831); ?> (pdo_sqlite prepared statements convert resources to strings). (Ilia)</li> +<li><?php bugfix(41815); ?> (Concurrent read/write fails when EOF is reached). (Sascha)</li> +<li><?php bugfix(41813); ?> (segmentation fault when using string offset as an object). (judas dot iscariote at gmail dot com, Tony)</li> +<li><?php bugfix(41795); ?> (checkdnsrr does not support DNS_TXT type). (lucas at facebook dot com, Tony)</li> +<li><?php bugfix(41773); ?> (php_strip_whitespace() sends headers with errors suppressed). (Tony)</li> +<li><?php bugfix(41770); ?> (SSL: fatal protocol error due to buffer issues). (Ilia)</li> +<li><?php bugfix(41765); ?> (Recode crashes/does not work on amd64). (nexus at smoula dot net, Stas)</li> +<li><?php bugfix(41724); ?> (libxml_get_last_error() - errors service request scope). (thekid at php dot net, Ilia)</li> +<li><?php bugfix(41717); ?> (imagepolygon does not respect thickness). (Pierre)</li> +<li><?php bugfix(41713); ?> (Persistent memory consumption on win32 since 5.2). (Dmitry)</li> +<li><?php bugfix(41711); ?> (NULL temporary lobs not supported in OCI8). (Chris Jones, Tony)</li> +<li><?php bugfix(41709); ?> (strtotime() does not handle 00.00.0000). (Derick)</li> +<li><?php bugfix(41698); ?> (float parameters truncated to integer in prepared statements). (Ilia)</li> +<li><?php bugfix(41692); ?> (ArrayObject shows weird behavior in respect to inheritance). (Tony)</li> +<li><?php bugfix(41691); ?> (ArrayObject::exchangeArray hangs Apache). (Tony)</li> +<li><?php bugfix(41686); ?> (Omitting length param in array_slice not possible). (Ilia)</li> +<li><?php bugfix(41685); ?> (array_push() fails to warn when next index is already occupied). (Ilia)</li> +<li><?php bugfix(41655); ?> (open_basedir bypass via glob()). (Ilia)</li> +<li><?php bugfix(41640); ?> (get_class_vars produces error on class constants). (Johannes)</li> +<li><?php bugfix(41635); ?> (SoapServer and zlib.output_compression with FastCGI result in major slowdown). (Dmitry)</li> +<li><?php bugfix(41633); ?> (Crash instantiating classes with self-referencing constants). (Dmitry)</li> +<li><?php bugfix(41630); ?> (segfault when an invalid color index is present in the image data). (Reported by Elliot wccoder@gmail dot com) (Pierre)</li> +<li><?php bugfix(41628); ?> (PHP settings leak between Virtual Hosts in Apache 1.3). (Scott, manuel at mausz dot at)</li> +<li><?php bugfix(41608); ?> (segfault on a weird code with objects and switch()). (Tony)</li> +<li><?php bugfix(41600); ?> (url rewriter tags doesn't work with namespaced tags). (Ilia)</li> +<li><?php bugfix(41596); ?> (Fixed a crash inside pdo_pgsql on some non-well-formed SQL queries). (Ilia)</li> +<li><?php bugfix(41594); ?> (OCI8 statement cache is flushed too frequently). (Tony)</li> +<li><?php bugfix(41582); ?> (SimpleXML crashes when accessing newly created element). (Tony)</li> +<li><?php bugfix(41576); ?> (configure failure when using --without-apxs or some other SAPIs disabling options). (Jani)</li> +<li><?php bugfix(41567); ?> (json_encode() double conversion is inconsistent with PHP). (Lucas, Ilia)</li> +<li><?php bugfix(41566); ?> (SOAP Server not properly generating href attributes). (Dmitry)</li> +<li><?php bugfix(41555); ?> (configure failure: regression caused by fix for #41265). (Jani)</li> +<li><?php bugfix(41527); ?> (WDDX deserialize numeric string array key). (Matt, Ilia)</li> +<li><?php bugfix(41523); ?> (strtotime('0000-00-00 00:00:00') is parsed as 1999-11-30). (Derick)</li> +<li><?php bugfix(41518); ?> (file_exists() warns of open_basedir restriction on non-existent file). (Tony)</li> +<li><?php bugfix(41445); ?> (parse_ini_file() has a problem with certain types of integer as sections). (Tony)</li> +<li><?php bugfix(41433); ?> (DBA: configure fails to include correct db.h for db4). (Jani)</li> +<li><?php bugfix(41372); ?> (Internal pointer of source array resets during array copying). (Dmitry)</li> +<li><?php bugfix(41350); ?> (my_thread_global_end() error during request shutdown on Windows). (Scott, Andrey)</li> +<li><?php bugfix(41278); ?> (get_loaded_extensions() should list Zend extensions). (Johannes)</li> +<li><?php bugfix(41127); ?> (Memory leak in ldap_{first|next}_attribute functions). (Jani)</li> +<li><?php bugfix(40757); ?> (get_object_vars get nothing in child class). (Dmitry)</li> +<li><?php bugfix(40705); ?> (Iterating within function moves original array pointer). (Dmitry)</li> +<li><?php bugfix(40509); ?> (key() function changed behaviour if global array is used within function). (Dmitry)</li> +<li><?php bugfix(40419); ?> (Trailing slash in CGI request does not work). (Dmitry)</li> +<li><?php bugfix(39330); ?> (apache2handler does not call shutdown actions before apache child die). (isk at ecommerce dot com, Gopal, Tony)</li> +<li><?php bugfix(39291); ?> (ldap_sasl_bind() misses the sasl_authc_id parameter). (diafour at gmail dot com, Jani)</li> +<li><?php bugfix(37715); ?> (array pointers resetting on copy). (Dmitry)</li> +<li><?php bugfix(37273); ?> (Symlinks and mod_files session handler allow open_basedir bypass). (Ilia)</li> +<li><?php bugfix(36492); ?> (Userfilters can leak buckets). (Sara)</li> +<li>Fixed bugs <?php bugl(36796); ?>, <?php bugl(36918); ?>, <?php bugl(41371); ?> (stream_set_blocking() does not work). (Jani)</li> +<li><?php bugfix(35981); ?> (pdo-pgsql should not use pkg-config when not present). (Jani)</li> +<li><?php bugfix(31892); ?> (PHP_SELF incorrect without cgi.fix_pathinfo, but turning on screws up PATH_INFO). (Dmitry)</li> +<li><?php bugfix(21197); ?> (socket_read() outputs error with PHP_NORMAL_READ). (Nuno, Jani) + +</ul> + +<hr /> + <a name="5.2.3"></a> <h3>Version 5.2.3</h3> <b>31-May-2007</b> http://cvs.php.net/viewvc.cgi/phpweb/archive/2007.xml?r1=1.12&r2=1.13&diff_format=u Index: phpweb/archive/2007.xml diff -u phpweb/archive/2007.xml:1.12 phpweb/archive/2007.xml:1.13 --- phpweb/archive/2007.xml:1.12 Mon Jul 16 16:43:14 2007 +++ phpweb/archive/2007.xml Thu Aug 30 23:36:27 2007 @@ -1,4 +1,4 @@ -<?xml version="1.0" encoding="utf-8"?> +\<?xml version="1.0" encoding="utf-8"?> <feed xmlns="http://www.w3.org/2005/Atom" xml:base="/" xmlns:php="http://php.net/ns/news"> <title>PHP.net news & announcements</title> <link href="/feed.atom" rel="self"/> @@ -10,6 +10,62 @@ <uri>http://php.net/contact</uri> <email>webmaster@php.net</email> </author> + + <entry xmlns="http://www.w3.org/2005/Atom"> + <title>PHP 5.2.4 Released</title> + <link href="/index.php#2007-08-30-1" rel="alternate" type="text/html"/> + <link href="/archive/2007.php#2007-08-30-1" rel="via" type="text/html"/> + <id>http://php.net/archive/2007.php#2007-08-30-1</id> + <published>2007-08-30T20:00:00+04:00</published> + <updated>2007-08-30T20:00:00+04:00</updated> + <category term="frontpage" label="PHP.net frontpage news"/> + <category term="releases" label="New PHP release"/> + <content type="xhtml"> + <div xmlns="http://www.w3.org/1999/xhtml"> +<p> +The PHP development team would like to announce the immediate +<a href="/downloads.php#v5">availability of PHP 5.2.4</a>. +This release focuses on improving the stability of the PHP 5.2.X +branch with over 120 various bug fixes in addition to resolving +several low priority security bugs. All users of PHP are encouraged +to upgrade to this release. +</p> + +<p> +Further details about the PHP 5.2.4 release can be found in the +<a href="/releases/5_2_4.php">release announcement for 5.2.4</a>, the full list of +changes is available in the <a href="/ChangeLog-5.php#5.2.4">ChangeLog for PHP 5</a>. +</p> + +<p> +<b>Security Enhancements and Fixes in PHP 5.2.4:</b> +</p> +<ul> + <li>Fixed a floating point exception inside wordwrap() (Reported by Mattias Bengtsson)</li> + <li>Fixed several integer overflows inside the GD extension (Reported by Mattias Bengtsson)</li> + <li>Fixed size calculation in chunk_split() (Reported by Gerhard Wagner)</li> + <li>Fixed integer overflow in str[c]spn(). (Reported by Stanislav Malyshev)</li> + <li>Fixed money_format() not to accept multiple %i or %n tokens. (Reported by Stanislav Malyshev)</li> + <li>Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Reported by Stefan Esser)</li> + <li>Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Reported by Stanislav Malyshev)</li> + <li>Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Reported by Maksymilian Arciemowicz)</li> + <li>Fixed a possible invalid read in glob() win32 implementation (CVE-2007-3806) (Reported by shinnai)</li> + <li>Fixed a possible buffer overflow in php_openssl_make_REQ (Reported by zatanzlatan at hotbrev dot com)</li> + <li>Fixed an open_basedir bypass inside glob() function (Reported by dr at peytz dot dk)</li> + <li>Fixed a possible open_basedir bypass inside session extension when the session file is a symlink (Reported by c dot i dot morris at durham dot ac dot uk)</li> + <li>Improved fix for MOPB-03-2007.</li> + <li>Corrected fix for CVE-2007-2872.</li> +</ul> + +<p> +For users upgrading to PHP 5.2 from PHP 5.0 and PHP 5.1, an upgrade guide is +available <a href="/migration52">here</a>, detailing the changes between +those releases and PHP 5.2.4. +</p> + </div> + </content> + </entry> + <entry xmlns="http://www.w3.org/2005/Atom"> <title>php|works 2007 in Atlanta</title> <link href="/conferences/index.php#2007-07-16-01" rel="alternate" type="text/html"/> http://cvs.php.net/viewvc.cgi/phpweb/include/version.inc?r1=1.16&r2=1.17&diff_format=u Index: phpweb/include/version.inc diff -u phpweb/include/version.inc:1.16 phpweb/include/version.inc:1.17 --- phpweb/include/version.inc:1.16 Thu Aug 23 22:59:13 2007 +++ phpweb/include/version.inc Thu Aug 30 23:36:27 2007 @@ -17,18 +17,18 @@ */ /* PHP 5 Release */ -$PHP_5_VERSION = "5.2.3"; -$PHP_5_DATE = "01 June 2007"; +$PHP_5_VERSION = "5.2.4"; +$PHP_5_DATE = "30 August 2007"; $PHP_5_MD5 = array( - "tar.bz2" => "eb50b751c8e1ced05bd012d5a0e4dec3", - "tar.gz" => "df79b04d63fc4c1ccb6d8ea58a9cf3ac", - "zip" => "ff6e5dc212823009e68f26d66d85cbac", - "installer" => "4d042f649d9c264477e1b421c64c6435", - "pecl.zip" => "0480ffaf5a5333e83d90d75cece54748", - "nts.zip" => "3b291d4081af3100b83e39b8aacc444a", - "pecl.nts" => "ddf283dc8a9c49c8d2c5f38ad697c051", + "tar.bz2" => "55c97a671fdabf462cc7a82971a656d2", + "tar.gz" => "0826e231c3148b29fd039d7a8c893ad3", + "zip" => "979b8a305b028b296b97ed72322026b2", + "installer" => "ad23dcc391a8c26c7d387eb5e9bf1ffb", + "pecl.zip" => "dd98dfe607ceb98e727c394d5bd679fb", + "nts.zip" => "7728b869cfe3b8b7f1751da0a298fc12", + "pecl.nts" => "44302972cffd2b9cf05cb7131b56056a", ); -$PHP_5_RC = "5.2.4RC3"; +$PHP_5_RC = false; /* PHP 4 Release */ $PHP_4_VERSION = "4.4.7"; http://cvs.php.net/viewvc.cgi/phpweb/releases/index.php?r1=1.13&r2=1.14&diff_format=u Index: phpweb/releases/index.php diff -u phpweb/releases/index.php:1.13 phpweb/releases/index.php:1.14 --- phpweb/releases/index.php:1.13 Fri Jul 13 07:11:47 2007 +++ phpweb/releases/index.php Thu Aug 30 23:36:27 2007 @@ -1,5 +1,5 @@ <?php -// $Id: index.php,v 1.13 2007/07/13 07:11:47 derick Exp $ +// $Id: index.php,v 1.14 2007/08/30 23:36:27 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/index.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; @@ -97,7 +97,8 @@ <option value="php-5.1.6.tar.gz">5.1.6</option> <option value="php-5.2.0.tar.gz">5.2.0</option> <option value="php-5.2.1.tar.gz">5.2.1</option> - <option value="php-5.2.2.tar.gz">5.2.1</option> + <option value="php-5.2.2.tar.gz">5.2.2</option> + <option value="php-5.2.3.tar.gz">5.2.3</option> </select> </p> </form> @@ -117,6 +118,38 @@ </p> <a name="v5"></a> +<a name="5.2.3"></a> +<h2>5.2.3</h2> + +<ul> + <li>Released: 31 May 2007</li> + <li>Announcement: <a href="/releases/5_2_3.php">English</a></li> + <li><a href="/ChangeLog-5.php#5.2.3">ChangeLog</a></li> + <li> + Download: + <ul> + <li> + <?php download_link('php-5.2.3.tar.bz2','Source (tar.bz2)'); ?><br /> + <span class="md5sum">md5: eb50b751c8e1ced05bd012d5a0e4dec3</span> + </li> + <li> + <?php download_link('php-5.2.3.tar.gz','Source (tar.gz)'); ?><br /> + <span class="md5sum">md5: df79b04d63fc4c1ccb6d8ea58a9cf3ac</span> + </li> + <li> + <?php download_link('php-5.2.3-Win32.zip','Windows binary'); ?><br /> + <span class="md5sum">md5: ff6e5dc212823009e68f26d66d85cbac</span> + </li> + <li> + <?php download_link('pecl-5.2.3-Win32.zip','Collection of PECL modules for PHP 5.2.3'); ?><br /> + <span class="md5sum">md5: 0480ffaf5a5333e83d90d75cece54748</span> + </li> + </ul> + </li> +</ul> + + +<a name="v5"></a> <a name="5.2.2"></a> <h2>5.2.2</h2> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_2_4.php?view=markup&rev=1.1 Index: phpweb/releases/5_2_4.php +++ phpweb/releases/5_2_4.php <?php // $Id: 5_2_4.php,v 1.1 2007/08/30 23:36:27 iliaa Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_2_4.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.2.4 Release Announcement"); ?> <h1>PHP 5.2.4 Release Announcement</h1> <p> The PHP development team would like to announce the immediate availability of PHP 5.2.4. This release focuses on improving the stability of the PHP 5.2.X branch with over 120 various bug fixes in addition to resolving several low priority security bugs. All users of PHP are encouraged to upgrade to this release. </p> <p> <b>Security Enhancements and Fixes in PHP 5.2.4:</b> </p> <ul> <li>Fixed a floating point exception inside wordwrap() (Reported by Mattias Bengtsson)</li> <li>Fixed several integer overflows inside the GD extension (Reported by Mattias Bengtsson)</li> <li>Fixed size calculation in chunk_split() (Reported by Gerhard Wagner)</li> <li>Fixed integer overflow in str[c]spn(). (Reported by Stanislav Malyshev)</li> <li>Fixed money_format() not to accept multiple %i or %n tokens. (Reported by Stanislav Malyshev)</li> <li>Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Reported by Stefan Esser)</li> <li>Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Reported by Stanislav Malyshev)</li> <li>Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Reported by Maksymilian Arciemowicz)</li> <li>Fixed a possible invalid read in glob() win32 implementation (CVE-2007-3806) (Reported by shinnai)</li> <li>Fixed a possible buffer overflow in php_openssl_make_REQ (Reported by zatanzlatan at hotbrev dot com)</li> <li>Fixed an open_basedir bypass inside glob() function (Reported by dr at peytz dot dk)</li> <li>Fixed a possible open_basedir bypass inside session extension when the session file is a symlink (Reported by c dot i dot morris at durham dot ac dot uk)</li> <li>Improved fix for MOPB-03-2007.</li> <li>Corrected fix for CVE-2007-2872.</li> </ul> <p> <b>Key enhancements in PHP 5.2.4 include:</b> </p> <ul> <li>Upgraded PCRE to version 7.2</li> <li>Added persistent connection status checker to pdo_pgsql.</li> <li>Fixed oci8 and PDO_OCI extensions to allow configuring with Oracle 11g client libraries.</li> <li>Fixed bug #41831 (pdo_sqlite prepared statements convert resources to strings).</li> <li>Fixed bug #41770 (SSL: fatal protocol error due to buffer issues)</li> <li>Fixed bug #41713 (Persistent memory consumption on win32 since 5.2)</li> <li>Over 120 bug fixes.</li> </ul> <p> For users upgrading from PHP 5.0 and PHP 5.1, an upgrade guide is available <a href="/UPDATE_5_2.txt">here</a>, detailing the changes between those releases and PHP 5.2.4. </p> <p> For a full list of changes in PHP 5.2.4, see the <a href="/ChangeLog-5.php#5.2.4">ChangeLog</a>. </p> <?php site_footer(); ?>