Loading ...
Sorry, an error occurred while loading the content.
 

PHP 5.2.2 Released

Expand Messages
  • Vinu Thomas
    From the PHP Announcement List: The PHP development team would like to announce the immediate availability of PHP 5.2.2 and availability of PHP 4.4.7. These
    Message 1 of 1 , May 5, 2007
      From the PHP Announcement List:





      The PHP development team would like to announce the immediate
      availability of PHP 5.2.2 and availability of PHP 4.4.7. These releases
      are major stability and security enhancements of the 5.x and 4.4.x
      branches, and all users are strongly encouraged to upgrade to it as soon
      as possible. Further details about the PHP 5.2.2 release can be found in
      the release announcement for 5.2.2
      (http://www.php.net/releases/5_2_2.php). Details about the PHP 4.4.7
      release can be found in the release announcement for 4.4.7
      (http://www.php.net/releases/4_4_7.php).
      Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:
      * Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan
      Fratric)
      * Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan
      Esser)
      * Fixed a bug in mb_parse_str() that can be used to activate
      register_globals (MOPB-26 by Stefan Esser)
      * Fixed unallocated memory access/double free in in
      array_user_key_compare() (MOPB-24 by Stefan Esser)
      * Fixed a double free inside session_regenerate_id() (MOPB-22 by
      Stefan Esser)
      * Added missing open_basedir & safe_mode checks to zip:// and bzip://
      wrappers. (MOPB-21 by Stefan Esser).
      * Limit nesting level of input variables with max_input_nesting_level
      as fix for (MOPB-03 by Stefan Esser)
      * Fixed CRLF injection inside ftp_putcmd(). (by
      loveshell[at]Bug.Center.Team)
      * Fixed a possible super-global overwrite inside
      import_request_variables(). (by Stefano Di Paola, Stefan Esser)
      * Fixed a remotely trigger-able buffer overflow inside bundled
      libxmlrpc library. (by Stanislav Malyshev)
      Security Enhancements and Fixes in PHP 5.2.2 only:
      * Fixed a header injection via Subject and To parameters to the
      mail() function (MOPB-34 by Stefan Esser)
      * Fixed wrong length calculation in unserialize S type (MOPB-29 by
      Stefan Esser)
      * Fixed substr_compare and substr_count information leak (MOPB-14 by
      Stefan Esser) (Stas, Ilia)
      * Fixed a remotely trigger-able buffer overflow inside
      make_http_soap_request(). (by Ilia Alshanetsky)
      * Fixed a buffer overflow inside user_filter_factory_create(). (by
      Ilia Alshanetsky)
      Security Enhancements and Fixes in PHP 4.4.7 only:
      * XSS in phpinfo() (MOPB-8 by Stefan Esser)

      While majority of the issues outlined above are local, in some
      circumstances given specific code paths they can be triggered
      externally. Therefor, we strongly recommend that if you use code
      utilizing the functions and extensions identified as having had
      vulnerabilities in them, you consider upgrading your PHP.

      Ilia Alshanetsky
      PHP 5.2 Release Master



      [Non-text portions of this message have been removed]
    Your message has been successfully submitted and would be delivered to recipients shortly.