From: Stanislav Malyshev Date: Mon, 6 Apr 2015 05:36:55 +0000 (-0700) Subject: Merge branch 'PHP-5.4' into PHP-5.5 X-Git-Tag: php-5.5.25RC1~56 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=66b853d4261a813287ab5e379392e418bf715e82;p=php Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: Fix bug #66550 (SQLite prepared statement use-after-free) --- 66b853d4261a813287ab5e379392e418bf715e82 diff --cc NEWS index 6de9b29564,f8f046c056..2bc4f7c9cd --- a/NEWS +++ b/NEWS @@@ -1,149 -1,32 +1,152 @@@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| -?? ??? 2015 PHP 5.4.40 +?? ??? 2015, PHP 5.5.25 -- GD: - . Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (Remi) +- cURL: + . Fixed bug #68739 (Missing break / control flow). (Laruence) -- SOAP: - . Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize() - with SoapFault). (Dmitry) +- Ereg: + . Fixed bug #68740 (NULL Pointer Dereference). (Laruence) + +- ODBC: + . Fixed bug #69354 (Incorrect use of SQLColAttributes with ODBC 3.0). + (Anatol) + +- OPCache: + . Fixed bug #69281 (opcache_is_script_cached no longer works). (danack) + . Fixed bug #68677 (Use After Free). (CVE-2015-1351) (Laruence) + - Sqlite3: + . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan) + +?? ??? 2015, PHP 5.5.24 + +- Core: + . Fixed bug #66609 (php crashes with __get() and ++ operator in some cases). + (Dmitry, Laruence) + . Fixed bug #67626 (User exceptions not properly handled in streams). + (Julian) + . Fixed bug #68021 (get_browser() browser_name_regex returns non-utf-8 + characters). (Tjerk) + . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai) + . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM + configuration options). (Anatol Belski) + . Fixed bug #69212 (Leaking VIA_HANDLER func when exception thrown in + __call/... arg passing). (Nikita) + . Fixed bug #69221 (Segmentation fault when using a generator in combination + with an Iterator). (Nikita) + +- Date: + . Export date_get_immutable_ce so that it can be used by extensions. (Derick + Rethans) + . Fixed bug #69336 (Issues with "last day of "). (Derick Rethans) + +- Curl: + . Implemented FR#69278 (HTTP2 support). (Masaki Kagaya) + +- Enchant: + . Fixed bug #65406 (Enchant broker plugins are in the wrong place in windows + builds). (Anatol) + +- Filter: + . Fixed bug #69202 (FILTER_FLAG_STRIP_BACKTICK ignored unless other + flags are used). (Jeff Welch) + . Fixed bug #69203 (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127). (Jeff + Welch) + +- Mbstring: + . Fixed bug #68846 (False detection of CJK Unified Ideographs Extension E). + (Masaki Kagaya) + +- OpenSSL: + . Fixed bug #67403 (Add signatureType to openssl_x509_parse). + . Add a check for RAND_egd to allow compiling against LibreSSL (Leigh) + +- Phar: + . Fixed bug #64343 (PharData::extractTo fails for tarball created by BSD tar). + (Mike) + . Fixed bug #64931 (phar_add_file is too restrictive on filename). (Mike) + . Fixed bug #65467 (Call to undefined method cli_arg_typ_string). (Mike) + . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing + ".tar"). (Mike) + - Postgres: - . Fixed bug #68741 (Null pointer deference) (CVE-2015-1352). (Xinchen Hui) + . Fixed bug #68741 (Null pointer dereference). (CVE-2015-1352) (Laruence) + +- SPL: + . Fixed bug #69227 (Use after free in zval_scan caused by + spl_object_storage_get_gc). (adam dot scarr at 99designs dot com) + +- SOAP: + . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader + (bisected, regression)). (thomas at shadowweb dot org, Laruence) + +- SQLITE: + . Fixed bug #68760 (SQLITE segfaults if custom collator throws an exception). + (Dan Ackroyd) + . Fixed bug #69287 (Upgrade bundled sqlite to 3.8.8.3). (Anatol) -19 Mar 2015 PHP 5.4.39 +19 Mar 2015, PHP 5.5.23 - Core: - . Fixed bug #68976 (Use After Free Vulnerability in unserialize()) - (CVE-2015-0231). (Stas) + . Fixed bug #69174 (leaks when unused inner class use traits precedence). + (Laruence) + . Fixed bug #69139 (Crash in gc_zval_possible_root on unserialize). + (Laruence) + . Fixed bug #69121 (Segfault in get_current_user when script owner is not + in passwd with ZTS build). (dan at syneto dot net) + . Fixed bug #65593 (Segfault when calling ob_start from output buffering + callback). (Mike) + . Fixed bug #69017 (Fail to push to the empty array with the constant value + defined in class scope). (Laruence) + . Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file + not validated in memory.c). (nayana at ddproperty dot com) + . Fixed bug #68166 (Exception with invalid character causes segv). (Rasmus) + . Fixed bug #69141 (Missing arguments in reflection info for some builtin + functions). (kostyantyn dot lysyy at oracle dot com) + . Fixed bug #68976 (Use After Free Vulnerability in unserialize()). + (CVE-2015-2787) (Stas) . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options). (Anatol Belski) - . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas) + . Fixed bug #69207 (move_uploaded_file allows nulls in path). (CVE-2015-2348) + (Stas) + +- CGI: + . Fixed bug #69015 (php-cgi's getopt does not see $argv). (Laruence) + +- CLI: + . Fixed bug #67741 (auto_prepend_file messes up __LINE__). (Reeze Xia) + +- cURL: + . Fixed bug #69088 (PHP_MINIT_FUNCTION does not fully initialize cURL on + Win32). (Grant Pannell) + . Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported + by libcurl. (Linus Unneback) - Ereg: - . Fixed bug #69248 (heap overflow vulnerability in regcomp.c) (CVE-2015-2305). - (Stas) + . Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (CVE-2015-2305) (Stas) + +- FPM: + . Fixed bug #68822 (request time is reset too early). (honghu069 at 163 dot com) + +- ODBC: + . Fixed bug #68964 (Allowed memory size exhausted with odbc_exec). (Anatol) + +- Opcache: + . Fixed bug #69125 (Array numeric string as key). (Laruence) + . Fixed bug #69038 (switch(SOMECONSTANT) misbehaves). (Laruence) + +- OpenSSL: + . Fixed bugs #61285, #68329, #68046, #41631 (encrypted streams don't observe + socket timeouts). (Brad Broerman) + +- pgsql: + . Fixed bug #68638 (pg_update() fails to store infinite values). + (william dot welter at 4linux dot com dot br, Laruence) + +- Readline: + . Fixed bug #69054 (Null dereference in readline_(read|write)_history() without + parameters). (Laruence) - SOAP: . Fixed bug #69085 (SoapClient's __call() type confusion through