Re: [ANNOUNCE] PHP 5.3.7 Released!

On Thu, Aug 18, 2011 at 8:05 AM, Ilia Alshanetsky <[email protected]> wrote:

> The PHP development team would like to announce the immediate
> availability of PHP 5.3.7. This release focuses on improving the
> stability of the PHP 5.3.x branch with over 90 bug fixes, some of
> which are security related.
>
> Security Enhancements and Fixes in PHP 5.3.7:
>
>  * Updated crypt_blowfish to 1.2. (CVE-2011-2483)
>  * Fixed crash in error_log(). Reported by Mateusz Kocielski
>  * Fixed buffer overflow on overlog salt in crypt().
>  * Fixed bug #54939 (File path injection vulnerability in RFC1867
> File upload filename). Reported by Krzysztof Kotowicz. (CVE-2011-2202)
>  * Fixed stack buffer overflow in socket_connect(). (CVE-2011-1938)
>  * Fixed bug #54238 (use-after-free in substr_replace()). (CVE-2011-1148)
>
> Key enhancements in PHP 5.3.7 include:
>
>  * Upgraded bundled Sqlite3 to version 3.7.7.1
>  * Upgraded bundled PCRE to version 8.12
>  * Fixed bug #54910 (Crash when calling call_user_func with unknown
> function name)
>  * Fixed bug #54585 (track_errors causes segfault)
>  * Fixed bug #54262 (Crash when assigning value to a dimension in a
> non-array)
>  * Fixed a crash inside dtor for error handling
>  * Fixed bug #55339 (Segfault with allow_call_time_pass_reference = Off)
>  * Fixed bug #54935 php_win_err can lead to crash
>  * Fixed bug #54332 (Crash in zend_mm_check_ptr // Heap corruption)
>  * Fixed bug #54305 (Crash in gc_remove_zval_from_buffer)
>  * Fixed bug #54580 (get_browser() segmentation fault when browscap
> ini directive is set through php_admin_value)
>  * Fixed bug #54529 (SAPI crashes on apache_config.c:197)
>  * Fixed bug #54283 (new DatePeriod(NULL) causes crash).
>  * Fixed bug #54269 (Short exception message buffer causes crash)
>  * Fixed Bug #54221 (mysqli::get_warnings segfault when used in multi
> queries)
>  * Fixed bug #54395 (Phar::mount() crashes when calling with wrong
> parameters)
>  * Fixed bug #54384 (Dual iterators, GlobIterator, SplFileObject and
> SplTempFileObject crash when user-space classes don't call the parent
> constructor)
>  * Fixed bug #54292 (Wrong parameter causes crash in
> SplFileObject::__construct())
>  * Fixed bug #54291 (Crash iterating DirectoryIterator for dir name
> starting with \0)
>  * Fixed bug #54281 (Crash in non-initialized RecursiveIteratorIterator)
>  * Fixed bug #54623 (Segfault when writing to a persistent socket
> after closing a copy of the socket)
>  * Fixed bug #54681 (addGlob() crashes on invalid flags)
>  * Over 80 other bug fixes.
>
> Windows users: please mind that we do no longer provide builds created
> with Visual Studio C++ 6. It is impossible to maintain a high quality
> and safe build of PHP for Windows using this unmaintained compiler.
>
> For Apache SAPIs (php5_apache2_2.dll), be sure that you use a Visual
> Studio C++ 9 version of Apache. We recommend the Apache builds as
> provided by ApacheLounge. For any other SAPI (CLI, FastCGI via
> mod_fcgi, FastCGI with IIS or other FastCGI capable server),
> everything works as before. Third party extension providers  must
> rebuild their extensions to make them compatible and loadable with the
> Visual Studio C++9 builds that we now provide.</p>
>
> All PHP users should note that the PHP 5.2 series is NOT supported
> anymore. All users are strongly encouraged to upgrade to PHP 5.3.7.
>
> --
> PHP Announcements Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>