summaryrefslogtreecommitdiff
path: root/lang/php
AgeCommit message (Collapse)AuthorFilesLines
2016-03-09Pullup ticket #4946 - requested by tacabsiegert1-2/+2
lang/php70: security fix Revisions pulled up: - lang/php/phpversion.mk 1.128 - lang/php70/distinfo 1.6 - lang/php70/patches/patch-configure 1.2 - lang/php70/patches/patch-ext_opcache_config.m4 deleted --- Module Name: pkgsrc Committed By: taca Date: Sat Mar 5 05:20:17 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php70: distinfo pkgsrc/lang/php70/patches: patch-configure Removed Files: pkgsrc/lang/php70/patches: patch-ext_opcache_config.m4 Log Message: Update php70 to 7.0.4 (PHP 7.0.4), including security fxies. 03 Mar 2016 PHP 7.0.4 - Core: . Fixed bug (Low probability segfault in zend_arena). (Laruence) . Fixed bug #71441 (Typehinted Generator with return in try/finally crashes). (Bob) . Fixed bug #71442 (forward_static_call crash). (Laruence) . Fixed bug #71443 (Segfault using built-in webserver with intl using symfony). (Laruence) . Fixed bug #71449 (An integer overflow bug in php_implode()). (Stas) . Fixed bug #71450 (An integer overflow bug in php_str_to_str_ex()). (Stas) . Fixed bug #71474 (Crash because of VM stack corruption on Magento2). (Dmitry) . Fixed bug #71485 (Return typehint on internal func causes Fatal error when it throws exception). (Laruence) . Fixed bug #71529 (Variable references on array elements don't work when using count). (Nikita) . Fixed bug #71601 (finally block not executed after yield from). (Bob) . Fixed bug #71637 (Multiple Heap Overflow due to integer overflows in xml/filter_url/addcslashes). (Stas) - CLI server: . Fixed bug #71559 (Built-in HTTP server, we can download file in web by bug). (Johannes, Anatol) - CURL: . Fixed bug #71523 (Copied handle with new option CURLOPT_HTTPHEADER crashes while curl_multi_exec). (Laruence) . Fixed memory leak in curl_getinfo(). (Leigh) - Date: . Fixed bug #71525 (Calls to date_modify will mutate timelib_rel_time, causing date_date_set issues). (Sean DuBois) - Fileinfo: . Fixed bug #71434 (finfo throws notice for specific python file). (Laruence) - FPM: . Fixed bug #62172 (FPM not working with Apache httpd 2.4 balancer/fcgi setup). (Matt Haught, Remi) . Fixed bug #71269 (php-fpm dumped core). (Mickaël) - Opcache: . Fixed bug #71584 (Possible use-after-free of ZCG(cwd) in Zend Opcache). (Yussuf Khalil) - PCRE: . Fixed bug #71537 (PCRE segfault from Opcache). (Laruence) - phpdbg: . Fixed inherited functions from unspecified files being included in phpdbg_get_executable(). (Bob) - SOAP: . Fixed bug #71610 (Type Confusion Vulnerability - SOAP / make_http_soap_request()). (Stas) - Standard: . Fixed bug #71603 (compact() maintains references in php7). (Laruence) . Fixed bug #70720 (strip_tags improper php code parsing). (Julien) - XMLRPC: . Fixed bug #71501 (xmlrpc_encode_request ignores encoding option). (Hieu Le) - Zip: . Fixed bug #71561 (NULL pointer dereference in Zip::ExtractTo). (Laruence)
2016-03-08Pullup ticket #4945 - requested by tacabsiegert1-2/+2
lang/php56: security fix Revisions pulled up: - lang/php/phpversion.mk 1.127 - lang/php56/distinfo 1.24 --- Module Name: pkgsrc Committed By: taca Date: Sat Mar 5 05:18:51 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php56: distinfo Log Message: Update php56 to 5.6.19 (PHP 5.6.19), including security fixes. 03 Mar 2016, PHP 5.6.19 - CLI server: . Fixed bug #71559 (Built-in HTTP server, we can download file in web by bug). (Johannes, Anatol) - CURL: . Fixed bug #71523 (Copied handle with new option CURLOPT_HTTPHEADER crashes while curl_multi_exec). (Laruence) - Date: . Fixed bug #68078 (Datetime comparisons ignore microseconds). (Willem-Jan Zijderveld) . Fixed bug #71525 (Calls to date_modify will mutate timelib_rel_time, causing date_date_set issues). (Sean DuBois) - Fileinfo: . Fixed bug #71434 (finfo throws notice for specific python file). (Laruence) - FPM: . Fixed bug #62172 (FPM not working with Apache httpd 2.4 balancer/fcgi setup). (Matt Haught, Remi) - Opcache: . Fixed bug #71584 (Possible use-after-free of ZCG(cwd) in Zend Opcache). (Yussuf Khalil) - PDO MySQL: . Fixed bug #71569 (#70389 fix causes segmentation fault). (Nikita) - Phar: . Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()). (Stas) - Standard: . Fixed bug #70720 (strip_tags improper php code parsing). (Julien) - WDDX: . Fixed bug #71587 (Use-After-Free / Double-Free in WDDX Deserialize). (Stas) - XSL: . Fixed bug #71540 (NULL pointer dereference in xsl_ext_function_php()). (Stas) - Zip: . Fixed bug #71561 (NULL pointer dereference in Zip::ExtractTo). (Laruence)
2016-03-08Pullup ticket #4944 - requested by tacabsiegert1-2/+2
lang/php55: security fix Revisions pulled up: - lang/php/phpversion.mk 1.126 - lang/php55/distinfo 1.50 --- Module Name: pkgsrc Committed By: taca Date: Sat Mar 5 05:17:33 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php55: distinfo Log Message: Update php55 to 5.5.33, security fixes. 03 Mar 2016, PHP 5.5.33 - Phar: . Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()). (Stas) - WDDX: . Fixed bug #71587 (Use-After-Free / Double-Free in WDDX Deserialize). (Stas)
2016-02-10Pullup ticket #4918 - requested by tacabsiegert1-2/+2
lang/php70: security fix Revisions pulled up: - lang/php/phpversion.mk 1.125 - lang/php70/distinfo 1.4-1.5 - lang/php70/patches/patch-ext_pcre_pcrelib_config.h 1.1-1.2 --- Module Name: pkgsrc Committed By: jklos Date: Thu Jan 21 21:47:24 UTC 2016 Modified Files: pkgsrc/lang/php70: distinfo Added Files: pkgsrc/lang/php70/patches: patch-ext_pcre_pcrelib_config.h Log Message: Selectively enable just-in-time support in PCRE for supported architectures. Same issue as seen in older php: https://mail-index.netbsd.org/pkgsrc-bugs/2015/09/13/msg057792.html --- Module Name: pkgsrc Committed By: taca Date: Sat Feb 6 07:14:44 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php70: distinfo pkgsrc/lang/php70/patches: patch-ext_pcre_pcrelib_config.h Log Message: Update php70 to 7.0.3 (PHP 7.0.3). 04 Feb 2016 PHP 7.0.3 - Core: . Added support for new HTTP 451 code. (Julien) . Fixed bug #71039 (exec functions ignore length but look for NULL termination). (Anatol) . Fixed bug #71089 (No check to duplicate zend_extension). (Remi) . Fixed bug #71201 (round() segfault on 64-bit builds). (Anatol) . Fixed bug #71221 (Null pointer deref (segfault) in get_defined_vars via ob_start). (hugh at allthethings dot co dot nz) . Fixed bug #71248 (Wrong interface is enforced). (Dmitry) . Fixed bug #71273 (A wrong ext directory setup in php.ini leads to crash). (Anatol) . Fixed Bug #71275 (Bad method called on cloning an object having a trait). (Bob) . Fixed bug #71297 (Memory leak with consecutive yield from). (Bob) . Fixed bug #71300 (Segfault in zend_fetch_string_offset). (Laruence) . Fixed bug #71314 (var_export(INF) prints INF.0). (Andrea) . Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input). (Leo Gaspard) . Fixed bug #71336 (Wrong is_ref on properties as exposed via get_object_vars()). (Laruence) . Fixed bug #71459 (Integer overflow in iptcembed()). (Stas) - Apache2handler: . Fix >2G Content-Length headers in apache2handler. (Adam Harvey) - CURL: . Fixed bug #71227 (Can't compile php_curl statically). (Anatol) . Fixed bug #71225 (curl_setopt() fails to set CURLOPT_POSTFIELDS with reference to CURLFile). (Laruence) - Interbase: . Fixed Bug #71305 (Crash when optional resource is omitted). (Laruence, Anatol) - LDAP: . Fixed bug #71249 (ldap_mod_replace/ldap_mod_add store value as string "Array"). (Laruence) - mbstring: . Fixed bug #71397 (mb_send_mail segmentation fault). (Andrea, Yasuo) - OpenSSL: . Fixed bug #71475 (openssl_seal() uninitialized memory usage). (Stas) - Phar: . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (Stas) . Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()). (Stas) . Fixed bug #71488 (Stack overflow when decompressing tar archives). (Stas) - SOAP: . Fixed bug #70979 (crash with bad soap request). (Anatol) - SPL: . Fixed bug #71204 (segfault if clean spl_autoload_funcs while autoloading). (Laruence) . Fixed bug #71202 (Autoload function registered by another not activated immediately). (Laruence) . Fixed bug #71311 (Use-after-free vulnerability in SPL(ArrayObject, unserialize)). (Sean Heelan) . Fixed bug #71313 (Use-after-free vulnerability in SPL(SplObjectStorage, unserialize)). (Sean Heelan) - Standard: . Fixed bug #71287 (Error message contains hexadecimal instead of decimal number). (Laruence) . Fixed bug #71264 (file_put_contents() returns unexpected value when filesystem runs full). (Laruence) . Fixed bug #71245 (file_get_contents() ignores "header" context option if it's a reference). (Laruence) . Fixed bug #71220 (Null pointer deref (segfault) in compact via ob_start). (hugh at allthethings dot co dot nz) . Fixed bug #71190 (substr_replace converts integers in original $search array to strings). (Laruence) . Fixed bug #71188 (str_replace converts integers in original $search array to strings). (Laruence) . Fixed bug #71132, #71197 (range() segfaults). (Thomas Punt) - WDDX: . Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization). (Stas)
2016-02-10Pullup ticket #4917 - requested by tacabsiegert1-2/+2
lang/php56: security fix Revisions pulled up: - lang/php/phpversion.mk 1.124 - lang/php56/distinfo 1.22 --- Module Name: pkgsrc Committed By: taca Date: Sat Feb 6 07:13:02 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php56: distinfo Log Message: Update php56 to 5.6.18 (PHP 5.6.18). 04 Feb 2016, PHP 5.6.18 - Core: . Fixed bug #71039 (exec functions ignore length but look for NULL termination). (Anatol) . Fixed bug #71089 (No check to duplicate zend_extension). (Remi) . Fixed bug #71201 (round() segfault on 64-bit builds). (Anatol) . Added support for new HTTP 451 code. (Julien) . Fixed bug #71273 (A wrong ext directory setup in php.ini leads to crash). (Anatol) . Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input). (Leo Gaspard) . Fixed bug #71459 (Integer overflow in iptcembed()). (Stas) - Apache2handler: . Fix >2G Content-Length headers in apache2handler. (Adam Harvey) - FTP: . Implemented FR #55651 (Option to ignore the returned FTP PASV address). (abrender at elitehosts dot com) - Opcache: . Fixed bug #71127 (Define in auto_prepend_file is overwrite). (Laruence) . Fixed bug #71024 (Unable to use PHP 7.0 x64 side-by-side with PHP 5.6 x32 on the same server). (Anatol) - Phar: . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (Stas) . Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()). (Stas) . Fixed bug #71488 (Stack overflow when decompressing tar archives). (Stas) - Session: . Fixed bug #69111 (Crash in SessionHandler::read()). (Anatol) - SOAP: . Fixed bug #70979 (crash with bad soap request). (Anatol) - SPL: . Fixed bug #71204 (segfault if clean spl_autoload_funcs while autoloading). (Laruence) - WDDX: . Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization). (Stas)
2016-02-10Pullup ticket #4916 - requested by tacabsiegert1-2/+2
lang/php55: security fix Revisions pulled up: - lang/php/phpversion.mk 1.123 - lang/php55/distinfo 1.49 --- Module Name: pkgsrc Committed By: taca Date: Sat Feb 6 07:11:06 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php55: distinfo Log Message: Update php55 to 5.5.32 (PHP 5.5.32). 04 Feb 2016, PHP 5.5.32 - Core: . Fixed bug #71039 (exec functions ignore length but look for NULL termination). (Anatol) . Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input). (Leo Gaspard) . Fixed bug #71459 (Integer overflow in iptcembed()). (Stas) - GD: . Improved the fix for bug #70976. (Remi) - PCRE: . Upgraded pcrelib to 8.38. - Phar: . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (Stas) . Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()). (Stas) . Fixed bug #71488 (Stack overflow when decompressing tar archives). (Stas) - WDDX: . Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization). (Stas)
2016-01-18Pullup ticket #4893 - requested by tacabsiegert1-2/+2
lang/php70: security fix Revisions pulled up: - lang/php/phpversion.mk 1.122 - lang/php70/distinfo 1.3 --- Module Name: pkgsrc Committed By: taca Date: Fri Jan 8 03:29:12 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php70: distinfo Log Message: Update php70 to 7.0.2, including security fix. 07 Jan 2016 PHP 7.0.2 - Core: . Fixed bug #71165 (-DGC_BENCH=1 doesn't work on PHP7). (y dot uchiyama dot 1015 at gmail dot com) . Fixed bug #71163 (Segmentation Fault: cleanup_unfinished_calls). (Laruence) . Fixed bug #71109 (ZEND_MOD_CONFLICTS("xdebug") doesn't work). (Laruence) . Fixed bug #71092 (Segmentation fault with return type hinting). (Laruence) . Fixed bug memleak in header_register_callback. (Laruence) . Fixed bug #71067 (Local object in class method stays in memory for each call). (Laruence) . Fixed bug #66909 (configure fails utf8_to_mutf7 test). (Michael Orlitzky) . Fixed bug #70781 (Extension tests fail on dynamic ext dependency). (Francois Laupretre) . Fixed bug #71089 (No check to duplicate zend_extension). (Remi) . Fixed bug #71086 (Invalid numeric literal parse error within highlight_string() function). (Nikita) . Fixed bug #71154 (Incorrect HT iterator invalidation causes iterator reuse). (Nikita) . Fixed bug #52355 (Negating zero does not produce negative zero). (Andrea) . Fixed bug #66179 (var_export() exports float as integer). (Andrea) . Fixed bug #70804 (Unary add on negative zero produces positive zero). (Andrea) - CURL: . Fixed bug #71144 (Sementation fault when using cURL with ZTS). (Michael Maroszek, Laruence) - DBA: . Fixed key leak with invalid resource. (Laruence) - Filter: . Fixed bug #71063 (filter_input(INPUT_ENV, ..) does not work). (Reeze Xia) - FTP: . Implemented FR #55651 (Option to ignore the returned FTP PASV address). (abrender at elitehosts dot com) - FPM: . Fixed bug #70755 (fpm_log.c memory leak and buffer overflow). (Stas) - GD: . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (emmanuel dot law at gmail dot com). - Mbstring: . Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV, Segmentation fault). (Laruence) - Opcache: . Fixed bug #71127 (Define in auto_prepend_file is overwrite). (Laruence) - PCRE: . Fixed bug #71178 (preg_replace with arrays creates [0] in replace array if not already set). (Laruence) - Readline: . Fixed bug #71094 (readline_completion_function corrupts static array on second TAB). (Nikita) - Session: . Fixed bug #71122 (Session GC may not remove obsolete session data). (Yasuo) - SPL: . Fixed bug #71077 (ReflectionMethod for ArrayObject constructor returns wrong number of parameters). (Laruence) . Fixed bug #71153 (Performance Degradation in ArrayIterator with large arrays). (Nikita) - Standard: . Fixed bug #71270 (Heap BufferOver Flow in escapeshell functions). (emmanuel dot law at gmail dot com) - WDDX: . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization). (taoguangchen at icloud dot com) . Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability). (taoguangchen at icloud dot com) - XMLRPC . Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker). (Julien)
2016-01-17Pullup ticket #4892 - requested by tacabsiegert1-2/+2
lang/php56: security fix Revisions pulled up: - lang/php/phpversion.mk 1.121 - lang/php56/distinfo 1.21 --- Module Name: pkgsrc Committed By: taca Date: Fri Jan 8 03:28:20 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php56: distinfo Log Message: Update php55 to 5.6.17, including security fix. 07 Jan 2016, PHP 5.6.17 - Core: . Fixed bug #66909 (configure fails utf8_to_mutf7 test). (Michael Orlitzky) . Fixed bug #70958 (Invalid opcode while using ::class as trait method paramater default value). (Laruence) . Fixed bug #70957 (self::class can not be resolved with reflection for abstract class). (Laruence) . Fixed bug #70944 (try{ } finally{} can create infinite chains of exceptions). (Laruence) . Fixed bug #61751 (SAPI build problem on AIX: Undefined symbol: php_register_internal_extensions). (Lior Kaplan) - FPM: . Fixed bug #70755 (fpm_log.c memory leak and buffer overflow). (Stas) - GD: . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (emmanuel dot law at gmail dot com). - Mysqlnd: . Fixed bug #68077 (LOAD DATA LOCAL INFILE / open_basedir restriction). (Laruence) - SOAP: . Fixed bug #70900 (SoapClient systematic out of memory error). (Dmitry) - Standard: . Fixed bug #70960 (ReflectionFunction for array_unique returns wrong number of parameters). (Laruence) - PDO_Firebird: . Fixed bug #60052 (Integer returned as a 64bit integer on X64_86). (Mariuz) - WDDX: . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization). (taoguangchen at icloud dot com) . Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability). (taoguangchen at icloud dot com) - XMLRPC: . Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()). (Julien)
2016-01-17Pullup ticket #4891 - requested by tacabsiegert1-2/+2
lang/php55: security fix Revisions pulled up: - lang/php/phpversion.mk 1.120 - lang/php55/distinfo 1.48 --- Module Name: pkgsrc Committed By: taca Date: Fri Jan 8 03:27:23 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php55: distinfo Log Message: Update php55 to 5.5.31, security fix. 07 Jan 2015, PHP 5.5.31 - FPM: . Fixed bug #70755 (fpm_log.c memory leak and buffer overflow). (Stas) - GD: . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (emmanuel dot law at gmail dot com). - WDDX: . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization). (taoguangchen at icloud dot com) . Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability). (taoguangchen at icloud dot com) - XMLRPC: . Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()). (Julien)
2015-12-18Update php70 to 7.0.1, approved by gdt@.taca1-2/+2
17 Dec 2015, PHP 7.0.1 - Core: . Fixed bug #71105 (Format String Vulnerability in Class Name Error Message). (andrew at jmpesp dot org) . Fixed bug #70831 (Compile fails on system with 160 CPUs). (Daniel Axtens) . Fixed bug #71006 (symbol referencing errors on Sparc/Solaris). (Dmitry) . Fixed bug #70997 (When using parentClass:: instead of parent::, static context changed). (Dmitry) . Fixed bug #70970 (Segfault when combining error handler with output buffering). (Laruence) . Fixed bug #70967 (Weird error handling for __toString when Error is thrown). (Laruence) . Fixed bug #70958 (Invalid opcode while using ::class as trait method paramater default value). (Laruence) . Fixed bug #70944 (try{ } finally{} can create infinite chains of exceptions). (Laruence) . Fixed bug #70931 (Two errors messages are in conflict). (dams, Laruence) . Fixed bug #70904 (yield from incorrectly marks valid generator as finished). (Bob) . Fixed bug #70899 (buildconf failure in extensions). (Bob, Reeze) . Fixed bug #61751 (SAPI build problem on AIX: Undefined symbol: php_register_internal_extensions). (Lior Kaplan) . Fixed \int (or generally every scalar type name with leading backslash) to not be accepted as type name. (Bob) . Fixed exception not being thrown immediately into a generator yielding from an array. (Bob) . Fixed bug #70987 (static::class within Closure::call() causes segfault). (Andrea) . Fixed bug #71013 (Incorrect exception handler with yield from). (Bob) . Fixed double free in error condition of format printer. (Bob) - CLI server: . Fixed bug #71005 (Segfault in php_cli_server_dispatch_router()). (Adam) - Intl: . Fixed bug #71020 (Use after free in Collator::sortWithSortKeys). (emmanuel dot law at gmail dot com, Laruence) - Mysqlnd: . Fixed bug #68077 (LOAD DATA LOCAL INFILE / open_basedir restriction). (Laruence) . Fixed bug #68344 (MySQLi does not provide way to disable peer certificate validation) by introducing MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT connection flag. (Andrey) - OCI8: . Fixed LOB implementation size_t/zend_long mismatch reported by gcov. (Senthil) - Opcache: . Fixed #71024 (Unable to use PHP 7.0 x64 side-by-side with PHP 5.6 x32 on the same server). (Anatol) . Fixed bug #70991 (zend_file_cache.c:710: error: array type has incomplete element type). (Laruence) . Fixed bug #70977 (Segmentation fault with opcache.huge_code_pages=1). (Laruence) - Phpdbg: . Fixed stderr being written to stdout. (Bob) - Reflection: . Fixed bug #71018 (ReflectionProperty::setValue() behavior changed). (Laruence) . Fixed bug #70982 (setStaticPropertyValue behaviors inconsistently with 5.6). (Laruence) - SPL: . Fixed bug #71028 (Undefined index with ArrayIterator). (Laruence) - SQLite3: . Fixed bug #71049 (SQLite3Stmt::execute() releases bound parameter instead of internal buffer). (Laruence) - Standard: . Fixed bug #70999 (php_random_bytes: called object is not a function). (Scott) . Fixed bug #70960 (ReflectionFunction for array_unique returns wrong number of parameters). (Laruence) - Streams/Socket: . Add IPV6_V6ONLY constant / make it usable in stream contexts. (Bob) - Soap: . Fixed bug #70993 (Array key references break argument processing). (Laruence) - PDO_Firebird: . Fixed bug #60052 (Integer returned as a 64bit integer on X64_86). (Mariuz)
2015-12-11Avoid to use deprecated syntax. Fix runtime problem with PHP 7.taca1-4/+4
2015-12-06Add php70 support.taca1-10/+18
2015-12-05Remove php54 (PHP 5.4) support.taca1-22/+11
2015-11-28Update php56 to 5.6.16 (PHP 5.6.16).taca1-2/+2
26 Nov 2015, PHP 5.6.16 - Core: . Fixed bug #70828 (php-fpm 5.6 with opcache crashes when referencing a non-existent constant). (Laruence) . Fixed bug #70748 (Segfault in ini_lex () at Zend/zend_ini_scanner.l). (Laruence) - Mysqlnd: . Fixed bug #68344 (MySQLi does not provide way to disable peer certificate validation) by introducing MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT connection flag. (Andrey) - OCI8: . Fixed bug #68298 (OCI int overflow). (Senthil) - PDO_DBlib: . Fixed bug #69757 (Segmentation fault on nextRowset). (miracle at rpz dot name) - SOAP: . Fixed bug #70875 (Segmentation fault if wsdl has no targetNamespace attribute). (Matteo) - SPL: . Fixed bug #70852 (Segfault getting NULL offset of an ArrayObject). (Reeze Xia)
2015-10-31Update php56 to 5.6.15.taca1-2/+2
29 Oct 2015, PHP 5.6.15 - Core: . Fixed bug #70681 (Segfault when binding $this of internal instance method to null). (Nikita) . Fixed bug #70685 (Segfault for getClosure() internal method rebind with invalid $this). (Nikita) - Date: . Fixed bug #70619 (DateTimeImmutable segfault). (Laruence) - Mcrypt: . Fixed bug #70625 (mcrypt_encrypt() won't return data when no IV was specified under RC4). (Nikita) - Mysqlnd: . Fixed bug #70384 (mysqli_real_query():Unknown type 245 sent by the server). (Andrey) . Fixed bug #70572 segfault in mysqlnd_connect. (Andrey, Remi) - Opcache: . Fixed bug #70632 (Third one of segfault in gc_remove_from_buffer). (Laruence) . Fixed bug #70631 (Another Segfault in gc_remove_from_buffer()). (Laruence) . Fixed bug #70601 (Segfault in gc_remove_from_buffer()). (Laruence) . Fixed compatibility with Windows 10 (see also bug #70652). (Anatol)
2015-10-02Update php56 to 5.6.14.taca1-2/+2
01 Oct 2015, PHP 5.6.14 - Core: . Fixed bug #70370 (Bundled libtool.m4 doesn't handle FreeBSD 10 when building extensions). (Adam) - CLI server: . Fixed bug #68291 (404 on urls with '+'). (cmb) - DOM: . Fixed bug #70001 (Assigning to DOMNode::textContent does additional entity encoding). (cmb) - Mysqlnd: . Fixed bug #70456 (mysqlnd doesn't activate TCP keep-alive when connecting to a server). (Sergei Turchanov) - OpenSSL: . Fixed bug #55259 (openssl extension does not get the DH parameters from DH key resource). (Jakub Zelenka) . Fixed bug #70395 (Missing ARG_INFO for openssl_seal()). (cmb) . Fixed bug #60632 (openssl_seal fails with AES). (Jakub Zelenka) . Fixed bug #68312 (Lookup for openssl.cnf causes a message box). (Anatol) - PDO: . Fixed bug #70389 (PDO constructor changes unrelated variables). (Laruence) - Phar: . Fixed bug #69720 (Null pointer dereference in phar_get_fp_offset()). (Stas) . FIxed bug #70433 (Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"). (Stas) - Phpdbg: . Fix phpdbg_break_next() sometimes not breaking. (Bob) - Standard: . Fixed bug #67131 (setcookie() conditional for empty values not met). (cmb) - Streams: . Fixed bug #70361 (HTTP stream wrapper doesn't close keep-alive connections). (Niklas Keller) - Zip: . Fixed bug #70322 (ZipArchive::close() doesn't indicate errors). (cmb)
2015-10-02Update php55 to 5.5.30.taca1-2/+2
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ** PHP 5.5 is in security-only mode , please do not commit to this branch ** 01 Oct 2015, PHP 5.5.30 - Phar: . Fixed bug #69720 (Null pointer dereference in phar_get_fp_offset()). (Stas) . FIxed bug #70433 (Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"). (Stas)
2015-09-26php54 is EOL, switch PHP_VERSION_DEFAULT to 55, as discussed some time ago.bouyer1-4/+4
2015-09-06Update php55 to 5.6.13 including security fixes.taca1-2/+2
03 Sep 2015, PHP 5.6.13 - Core: . Fixed bug #69900 (Too long timeout on pipes). (Anatol) . Fixed bug #69487 (SAPI may truncate POST data). (cmb) . Fixed bug #70198 (Checking liveness does not work as expected). (Shafreeck Sea, Anatol Belski) . Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas) . Fixed bug #70219 (Use after free vulnerability in session deserializer). (taoguangchen at icloud dot com) - CLI server: . Fixed bug #66606 (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE). (wusuopu, cmb) . Fixed bug #70264 (CLI server directory traversal). (cmb) - Date: . Fixed bug #70266 (DateInterval::__construct.interval_spec is not supposed to be optional). (cmb) . Fixed bug #70277 (new DateTimeZone($foo) is ignoring text after null byte). (cmb) - EXIF: . Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes). (Stas) - hash: . Fixed bug #70312 (HAVAL gives wrong hashes in specific cases). (letsgolee at naver dot com) - MCrypt: . Fixed bug #69833 (mcrypt fd caching not working). (Anatol) - Opcache: . Fixed bug #70237 (Empty while and do-while segmentation fault with opcode on CLI enabled). (Dmitry, Laruence) - PCRE: . Fixed bug #70232 (Incorrect bump-along behavior with \K and empty string match). (cmb) . Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions). (Anatol Belski) - SOAP: . Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE). (Stas) - SPL: . Fixed bug #70290 (Null pointer deref (segfault) in spl_autoload via ob_start). (hugh at allthethings dot co dot nz) . Fixed bug #70303 (Incorrect constructor reflection for ArrayObject). (cmb) . Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage). (taoguangchen at icloud dot com) . Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList). (taoguangchen at icloud dot com) - Standard: . Fixed bug #70052 (getimagesize() fails for very large and very small WBMP). (cmb) . Fixed bug #70157 (parse_ini_string() segmentation fault with INI_SCANNER_TYPED). (Tjerk) - XSLT: . Fixed bug #69782 (NULL pointer dereference). (Stas) - ZIP: . Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories). (neal at fb dot com)
2015-09-06Update php55 to 5.5.29 including security fixes.taca1-2/+2
03 Sep 2015, PHP 5.5.29 - Core: . Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas) . Fixed bug #70219 (Use after free vulnerability in session deserializer). (taoguangchen at icloud dot com) - EXIF: . Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes). (Stas) - hash: . Fixed bug #70312 (HAVAL gives wrong hashes in specific cases). (letsgolee at naver dot com) - PCRE: . Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions). (Anatol Belski) - SOAP: . Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE). (Stas) - SPL: . Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage). (taoguangchen at icloud dot com) . Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList). (taoguangchen at icloud dot com) - XSLT: . Fixed bug #69782 (NULL pointer dereference). (Stas) - ZIP: . Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories). (neal at fb dot com)
2015-09-06Update php54 to 5.4.45 including security fixes.taca1-2/+2
03 Sep 2015 PHP 5.4.45 - Core: . Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas) . Fixed bug #70219 (Use after free vulnerability in session deserializer). (taoguangchen at icloud dot com) - EXIF: . Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes). (Stas) - hash: . Fixed bug #70312 (HAVAL gives wrong hashes in specific cases). (letsgolee at naver dot com) - PCRE: . Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions). (Anatol Belski) - SOAP: . Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE). (Stas) - SPL: . Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage). (taoguangchen at icloud dot com) . Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList). (taoguangchen at icloud dot com) - XSLT: . Fixed bug #69782 (NULL pointer dereference). (Stas) - ZIP: . Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories). (neal at fb dot com)
2015-08-23Add PEAR_PACKAGE_XML.taca1-3/+24
It specifies build package with pear command using package.xml or not. Default is yes.
2015-08-10Revert accidently commit.taca1-24/+3
2015-08-08Update php56 to 5.6.12.taca1-2/+2
06 Aug 2015, PHP 5.6.12 - Core: . Fixed bug #70012 (Exception lost with nested finally block). (Laruence) . Fixed bug #70002 (TS issues with temporary dir handling). (Anatol) . Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive method calls). (Stas) . Fixed bug #69892 (Different arrays compare indentical due to integer key truncation). (Nikita) . Fixed bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref). (Stas) - CLI server: . Fixed bug #69655 (php -S changes MKCALENDAR request method to MKCOL). (cmb) . Fixed bug #64878 (304 responses return Content-Type header). (cmb) - GD: . Fixed bug #53156 (imagerectangle problem with point ordering). (cmb) . Fixed bug #66387 (Stack overflow with imagefilltoborder). (cmb) . Fixed bug #70102 (imagecreatefromwebm() shifts colors). (cmb) . Fixed bug #66590 (imagewebp() doesn't pad to even length). (cmb) . Fixed bug #66882 (imagerotate by -90 degrees truncates image by 1px). (cmb) . Fixed bug #70064 (imagescale(..., IMG_BICUBIC) leaks memory). (cmb) . Fixed bug #69024 (imagescale segfault with palette based image). (cmb) . Fixed bug #53154 (Zero-height rectangle has whiskers). (cmb) . Fixed bug #67447 (imagecrop() add a black line when cropping). (cmb) . Fixed bug #68714 (copy 'n paste error). (cmb) . Fixed bug #66339 (PHP segfaults in imagexbm). (cmb) . Fixed bug #70047 (gd_info() doesn't report WebP support). (cmb) - ODBC: . Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns). (cmb) - OpenSSL: . Fixed bug #69882 (OpenSSL error “key values mismatch” after openssl_pkcs12_read with extra cert) (Tomasz Sawicki) . Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure). (Stas) - Phar: . Improved fix for bug #69441. (Anatol Belski) . Fixed bug #70019 (Files extracted from archive may be placed outside of destination directory). (Anatol Belski) - SOAP: . Fixed bug #70081 (SoapClient info leak / null pointer dereference via multiple type confusions). (Stas) - SPL: . Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items). (sean.heelan) . Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject). (taoguangchen at icloud dot com) . Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage). (taoguangchen at icloud dot com) . Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList). (taoguangchen at icloud dot com) - Standard: . Fixed bug #70096 (Repeated iptcembed() adds superfluous FF bytes). (cmb)
2015-08-08Update php55 to 5.5.28.taca1-2/+2
06 Aug 2015, PHP 5.5.28 - Core: . Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive method calls). (Stas) . Fixed bug #69892 (Different arrays compare indentical due to integer key truncation). (Nikita) . Fixed bug #70002 (TS issues with temporary dir handling). (Anatol) . Fixed bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref). (Stas) - OpenSSL: . Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure). (Stas) - Phar: . Improved fix for bug #69441. (Anatol Belski) . Fixed bug #70019 (Files extracted from archive may be placed outside of destination directory). (Anatol Belski) - SOAP: . Fixed bug #70081 (SoapClient info leak / null pointer dereference via multiple type confusions). (Stas) - SPL: . Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items). (sean.heelan) . Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject). (taoguangchen at icloud dot com) . Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage). (taoguangchen at icloud dot com) . Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList). (taoguangchen at icloud dot com)
2015-08-08Update phpt54 to 5.4.44.taca2-5/+26
06 Aug 2015 PHP 5.4.44 - Core: . Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive method calls). (Stas) . Fixed bug #69892 (Different arrays compare indentical due to integer key truncation). (Nikita) . Fixed bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref). (Stas) - OpenSSL: . Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure). (Stas) - Phar: . Improved fix for bug #69441. (Anatol Belski) . Fixed bug #70019 (Files extracted from archive may be placed outside of destination directory). (Anatol Belski) - SOAP: . Fixed bug #70081 (SoapClient info leak / null pointer dereference via multiple type confusions). (Stas) - SPL: . Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items). (sean.heelan) . Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject). (taoguangchen at icloud dot com) . Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage). (taoguangchen at icloud dot com) . Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList). (taoguangchen at icloud dot com)
2015-07-11Update php56 to 5.6.11.taca1-2/+2
10 Jul 2015, PHP 5.6.11 - Core: . Fixed bug #69768 (escapeshell*() doesn't cater to !). (cmb) . Fixed bug #69703 (Use __builtin_clzl on PowerPC). (dja at axtens dot net, Kalle) . Fixed bug #69732 (can induce segmentation fault with basic php code). (Dmitry) . Fixed bug #69642 (Windows 10 reported as Windows 8). (Christian Wenz, Anatol Belski) . Fixed bug #69551 (parse_ini_file() and parse_ini_string() segmentation fault). (Christoph M. Becker) . Fixed bug #69781 (phpinfo() reports Professional Editions of Windows 7/8/8.1/10 as "Business"). (Christian Wenz) . Fixed bug #69740 (finally in generator (yield) swallows exception in iteration). (Nikita) . Fixed bug #69835 (phpinfo() does not report many Windows SKUs). (Christian Wenz) . Fixed bug #69892 (Different arrays compare indentical due to integer key truncation). (Nikita) . Fixed bug #69874 (Can't set empty additional_headers for mail()), regression from fix to bug #68776. (Yasuo) - GD: . Fixed bug #61221 (imagegammacorrect function loses alpha channel). (cmb) - GMP: . Fixed bug #69803 (gmp_random_range() modifies second parameter if GMP number). (Nikita) - PCRE: . Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the string). (cmb) . Fixed bug #69864 (Segfault in preg_replace_callback) (cmb, ab) - PDO_pgsql: . Fixed bug #69752 (PDOStatement::execute() leaks memory with DML Statements when closeCuror() is u). (Philip Hofstetter) . Fixed bug #69362 (PDO-pgsql fails to connect if password contains a leading single quote). (Matteo) . Fixed bug #69344 (PDO PgSQL Incorrect binding numeric array with gaps). (Matteo) - SimpleXML: . Refactored the fix for bug #66084 (simplexml_load_string() mangles empty node name). (Christoph Michael Becker) - SPL: . Fixed bug #69737 (Segfault when SplMinHeap::compare produces fatal error). (Stas) . Fixed bug #67805 (SplFileObject setMaxLineLength). (Willian Gustavo Veiga). . Fixed bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()). (Laruence) - Sqlite3: . Fixed bug #69972 (Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()). (Laruence)
2015-07-11Update php55 to 5.5.27.taca1-2/+2
09 Jul 2015, PHP 5.5.27 - Core: . Fixed bug #69768 (escapeshell*() doesn't cater to !). (cmb) . Fixed bug #69703 (Use __builtin_clzl on PowerPC). (dja at axtens dot net, Kalle) . Fixed bug #69732 (can induce segmentation fault with basic php code). (Dmitry) . Fixed bug #69642 (Windows 10 reported as Windows 8). (Christian Wenz, Anatol Belski) . Fixed bug #69551 (parse_ini_file() and parse_ini_string() segmentation fault). (Christoph M. Becker) . Fixed bug #69781 (phpinfo() reports Professional Editions of Windows 7/8/8.1/10 as "Business"). (Christian Wenz) . Fixed bug #69835 (phpinfo() does not report many Windows SKUs). (Christian Wenz) . Fixed bug #69892 (Different arrays compare indentical due to integer key truncation). (Nikita) . Fixed bug #69874 (Can't set empty additional_headers for mail()), regression from fix to bug #68776. (Yasuo) - GD: . Fixed bug #61221 (imagegammacorrect function loses alpha channel). (cmb) - Mysqlnd: . Fixed bug #69669 (mysqlnd is vulnerable to BACKRONYM) (CVE-2015-3152). (Andrey) - PCRE: . Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the string). (cmb) . Fixed bug #69864 (Segfault in preg_replace_callback) (cmb, ab) - PDO_pgsql: . Fixed bug #69752 (PDOStatement::execute() leaks memory with DML Statements when closeCuror() is u). (Philip Hofstetter) . Fixed bug #69362 (PDO-pgsql fails to connect if password contains a leading single quote). (Matteo) . Fixed bug #69344 (PDO PgSQL Incorrect binding numeric array with gaps). (Matteo) - Phar: . Fixed bug #69958 (Segfault in Phar::convertToData on invalid file). (Stas) . Fixed bug #69923 (Buffer overflow and stack smashing error in phar_fix_filepath). (Stas) - SimpleXML: . Refactored the fix for bug #66084 (simplexml_load_string() mangles empty node name). (Christoph Michael Becker) - SPL: . Fixed bug #69737 (Segfault when SplMinHeap::compare produces fatal error). (Stas) . Fixed bug #67805 (SplFileObject setMaxLineLength). (Willian Gustavo Veiga).
2015-07-11Update php54 to 5.4.43.taca1-2/+2
09 Jul 2015 PHP 5.4.43 - Core: . Fixed bug #69768 (escapeshell*() doesn't cater to !). (cmb) . Fixed bug #69874 (Can't set empty additional_headers for mail()), regression from fix to bug #68776. (Yasuo) - Mysqlnd: . Fixed bug #69669 (mysqlnd is vulnerable to BACKRONYM) (CVE-2015-3152). (Andrey) - Phar: . Fixed bug #69958 (Segfault in Phar::convertToData on invalid file). (Stas) . Fixed bug #69923 (Buffer overflow and stack smashing error in phar_fix_filepath). (Stas)
2015-07-04Pear occasionally leaves some internal state files lying around. Do notbsiegert1-10/+12
only skip them in file checking but actively delete them at the end of the install. Fixes some OSX fallout that jperkin@ was seeing, plus PR pkg/49071.
2015-06-12Update php54 to 5.4.42.taca1-2/+2
11 Jun 2015 PHP 5.4.42 - Core: . Imroved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (Max Spelsberg) . Fixed bug #69646 (OS command injection vulnerability in escapeshellarg). (Anatol Belski) . Fixed bug #69719 (Incorrect handling of paths with NULs). (Stas) - Litespeed SAPI: . Fixed bug #68812 (Unchecked return value). (George Wang) - Mail: . Fixed bug #68776 (mail() does not have mail header injection prevention for additional headers). (Yasuo) - Postgres: . Fixed bug #69667 (segfault in php_pgsql_meta_data). (Remi) - Sqlite3: . Upgrade bundled sqlite to 3.8.10.2. (CVE-2015-3414, CVE-2015-3415, CVE-2015-3416) (Kaplan)
2015-06-12Update php56 to 5.6.10.taca1-2/+2
11 Jun 2015, PHP 5.6.10 - Core: . Fixed bug #66048 (temp. directory is cached during multiple requests). (Julien) . Fixed bug #69566 (Conditional jump or move depends on uninitialised value in extension trait). (jbboehr at gmail dot com) . Fixed bug #69599 (Strange generator+exception+variadic crash). (Nikita) . Fixed bug #69628 (complex GLOB_BRACE fails on Windows). (Christoph M. Becker) . Fixed POST data processing slowdown due to small input buffer size on Windows. (Jorge Oliveira, Anatol) . Fixed bug #69646 (OS command injection vulnerability in escapeshellarg). (Anatol Belski) . Fixed bug #69719 (Incorrect handling of paths with NULs). (Stas) - FTP . Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (Max Spelsberg) - GD: . Fixed bug #69479 (GD fails to build with newer libvpx). (Remi) - Iconv: . Fixed bug #48147 (iconv with //IGNORE cuts the string). (Stas) - Litespeed SAPI: . Fixed bug #68812 (Unchecked return value). (George Wang) - Mail: . Fixed bug #68776 (mail() does not have mail header injection prevention for additional headers). (Yasuo) - MCrypt: . Added file descriptor caching to mcrypt_create_iv() (Leigh) - Opcache . Fixed bug #69549 (Memory leak with opcache.optimization_level=0xFFFFFFFF). (Laruence, Dmitry) - Phar: . Fixed bug #69680 (phar symlink in binary directory broken). (Matteo Bernardini, Remi) - Postgres: . Fixed bug #69667 (segfault in php_pgsql_meta_data). (Remi) - Sqlite3: . Upgrade bundled sqlite to 3.8.10.2. (CVE-2015-3414, CVE-2015-3415, CVE-2015-3416) (Kaplan)
2015-06-12Update php55 to 5.5.26.taca1-2/+2
11 Jun 2015, PHP 5.5.26 - Core: . Fixed bug #69566 (Conditional jump or move depends on uninitialised value in extension trait). (jbboehr at gmail dot com) . Fixed bug #66048 (temp. directory is cached during multiple requests). (Julien) . Fixed bug #69628 (complex GLOB_BRACE fails on Windows). (Christoph M. Becker) . Fixed bug #69646 (OS command injection vulnerability in escapeshellarg). (Anatol Belski) . Fixed bug #69719 (Incorrect handling of paths with NULs). (Stas) - FTP: . Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (Max Spelsberg) - GD: . Fixed bug #69479 (GD fails to build with newer libvpx). (Remi) - Iconv: . Fixed bug #48147 (iconv with //IGNORE cuts the string). (Stas) - Litespeed SAPI: . Fixed bug #68812 (Unchecked return value). (George Wang) - Mail: . Fixed bug #68776 (mail() does not have mail header injection prevention for additional headers). (Yasuo) - MCrypt: . Added file descriptor caching to mcrypt_create_iv() (Leigh) - Opcache . Fixed bug #69549 (Memory leak with opcache.optimization_level=0xFFFFFFFF). (Laruence, Dmitry) - PCRE: . Upgraded pcrelib to 8.37. (CVE-2015-2325, CVE-2015-2326) - Phar: . Fixed bug #69680 (phar symlink in binary directory broken). (Matteo Bernardini, Remi) - Postgres: . Fixed bug #69667 (segfault in php_pgsql_meta_data). (Remi) - Sqlite3: . Upgrade bundled sqlite to 3.8.10.2. (CVE-2015-3414, CVE-2015-3415, CVE-2015-3416) (Kaplan)
2015-05-16Update php56 to 5.6.9.taca1-2/+2
14 May 2015, PHP 5.6.9 - Core: . Fixed bug #69467 (Wrong checked for the interface by using Trait). (Laruence) . Fixed bug #69420 (Invalid read in zend_std_get_method). (Laruence) . Fixed bug #60022 ("use statement [...] has no effect" depends on leading backslash). (Nikita) . Fixed bug #67314 (Segmentation fault in gc_remove_zval_from_buffer). (Dmitry) . Fixed bug #68652 (segmentation fault in destructor). (Dmitry) . Fixed bug #69419 (Returning compatible sub generator produces a warning). (Nikita) . Fixed bug #69472 (php_sys_readlink ignores misc errors from GetFinalPathNameByHandleA). (Jan Starke) . Fixed bug #69364 (PHP Multipart/form-data remote dos Vulnerability). (Stas) . Fixed bug #69403 (str_repeat() sign mismatch based memory corruption). (Stas) . Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (Stas) . Fixed bug #69522 (heap buffer overflow in unpack()). (Stas) - FTP: . Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (Stas) - ODBC: . Fixed bug #69354 (Incorrect use of SQLColAttributes with ODBC 3.0). (Anatol) . Fixed bug #69474 (ODBC: Query with same field name from two tables returns incorrect result). (Anatol) . Fixed bug #69381 (out of memory with sage odbc driver). (Frederic Marchall, Anatol Belski) - OpenSSL: . Fixed bug #69402 (Reading empty SSL stream hangs until timeout). (Daniel Lowrey) - PCNTL: . Fixed bug #68598 (pcntl_exec() should not allow null char). (Stas) - PCRE . Upgraded pcrelib to 8.37. - Phar: . Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (Stas)
2015-05-16Update php55 to 5.5.25.taca1-2/+2
14 May 2015, PHP 5.5.25 - Core: . Fixed bug #69364 (PHP Multipart/form-data remote dos Vulnerability). (Stas) . Fixed bug #69403 (str_repeat() sign mismatch based memory corruption). (Stas) . Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (Stas) . Fixed bug #69522 (heap buffer overflow in unpack()). (Stas) . Fixed bug #69467 (Wrong checked for the interface by using Trait). (Laruence) . Fixed bug #69420 (Invalid read in zend_std_get_method). (Laruence) . Fixed bug #60022 ("use statement [...] has no effect" depends on leading backslash). (Nikita) . Fixed bug #67314 (Segmentation fault in gc_remove_zval_from_buffer). (Dmitry) . Fixed bug #68652 (segmentation fault in destructor). (Dmitry) . Fixed bug #69419 (Returning compatible sub generator produces a warning). (Nikita) . Fixed bug #69472 (php_sys_readlink ignores misc errors from GetFinalPathNameByHandleA). (Jan Starke) - FTP: . Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (Stas) - ODBC: . Fixed bug #69474 (ODBC: Query with same field name from two tables returns incorrect result). (Anatol) . Fixed bug #69381 (out of memory with sage odbc driver). (Frederic Marchall, Anatol Belski) - OpenSSL: . Fixed bug #69402 (Reading empty SSL stream hangs until timeout). (Daniel Lowrey) - PCNTL: . Fixed bug #68598 (pcntl_exec() should not allow null char). (Stas) - Phar: . Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (Stas)
2015-05-16Update php54 to 5.4.41.taca1-2/+2
14 May 2015 PHP 5.4.41 - Core: . Fixed bug #69364 (PHP Multipart/form-data remote dos Vulnerability). (Stas) . Fixed bug #69403 (str_repeat() sign mismatch based memory corruption). (Stas) . Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (Stas) . Fixed bug #69522 (heap buffer overflow in unpack()). (Stas) - FTP: . Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (Stas) - PCNTL: . Fixed bug #68598 (pcntl_exec() should not allow null char). (Stas) - PCRE . Upgraded pcrelib to 8.37. - Phar: . Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (Stas)
2015-04-17Update php56 to 5.6.8.taca1-2/+2
16 Apr 2015, PHP 5.6.8 - Core: . Fixed bug #66609 (php crashes with __get() and ++ operator in some cases). (Dmitry, Laruence) . Fixed bug #68021 (get_browser() browser_name_regex returns non-utf-8 characters). (Tjerk) . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai) . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options). (Anatol Belski) . Additional fix for bug #69152 (Type confusion vulnerability in exception::getTraceAsString). (Stas) . Fixed bug #69210 (serialize function return corrupted data when sleep has non-string values). (Juan Basso) . Fixed bug #69212 (Leaking VIA_HANDLER func when exception thrown in __call/... arg passing). (Nikita) . Fixed bug #69221 (Segmentation fault when using a generator in combination with an Iterator). (Nikita) . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability). (Stas) . Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions). (Stas) - Apache2handler: . Fixed bug #69218 (potential remote code execution with apache 2.4 apache2handler). (Gerrit Venema) - cURL: . Implemented FR#69278 (HTTP2 support). (Masaki Kagaya) . Fixed bug #68739 (Missing break / control flow). (Laruence) . Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence) - Date: . Fixed bug #69336 (Issues with "last day of <monthname>"). (Derick Rethans) - Enchant: . Fixed bug #65406 (Enchant broker plugins are in the wrong place in windows builds). (Anatol) - Ereg: . Fixed bug #68740 (NULL Pointer Dereference). (Laruence) - Fileinfo: . Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault). (Anatol Belski) - Filter: . Fixed bug #69202: (FILTER_FLAG_STRIP_BACKTICK ignored unless other flags are used). (Jeff Welch) . Fixed bug #69203 (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127). (Jeff Welch) - OPCache: . Fixed bug #69297 (function_exists strange behavior with OPCache on disabled function). (Laruence) . Fixed bug #69281 (opcache_is_script_cached no longer works). (danack) . Fixed bug #68677 (Use After Free). (CVE-2015-1351) (Laruence) - OpenSSL . Fixed bugs #68853, #65137 (Buffered crypto stream data breaks IO polling in stream_select() contexts) (Chris Wright) . Fixed bug #69197 (openssl_pkcs7_sign handles default value incorrectly) (Daniel Lowrey) . Fixed bug #69215 (Crypto servers should send client CA list) (Daniel Lowrey) . Add a check for RAND_egd to allow compiling against LibreSSL (Leigh) - Phar: . Fixed bug #64343 (PharData::extractTo fails for tarball created by BSD tar). (Mike) . Fixed bug #64931 (phar_add_file is too restrictive on filename). (Mike) . Fixed bug #65467 (Call to undefined method cli_arg_typ_string). (Mike) . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing ".tar"). (Mike) . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas) . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode). (Stas) - Postgres: . Fixed bug #68741 (Null pointer dereference). (CVE-2015-1352) (Laruence) - SPL: . Fixed bug #69227 (Use after free in zval_scan caused by spl_object_storage_get_gc). (adam dot scarr at 99designs dot com) - SOAP: . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader (bisected, regression)). (Laruence) - Sqlite3: . Fixed bug #68760 (SQLITE segfaults if custom collator throws an exception). (Dan Ackroyd) . Fixed bug #69287 (Upgrade bundled libsqlite to 3.8.8.3). (Anatol) . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan)
2015-04-17Update php55 to 5.5.24.taca1-2/+2
16 Apr 2015, PHP 5.5.24 - Apache2handler: . Fixed bug #69218 (potential remote code execution with apache 2.4 apache2handler). (Gerrit Venema) - Core: . Fixed bug #66609 (php crashes with __get() and ++ operator in some cases). (Dmitry, Laruence) . Fixed bug #67626 (User exceptions not properly handled in streams). (Julian) . Fixed bug #68021 (get_browser() browser_name_regex returns non-utf-8 characters). (Tjerk) . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai) . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options). (Anatol Belski) . Additional fix for bug #69152 (Type confusion vulnerability in exception::getTraceAsString). (Stas) . Fixed bug #69212 (Leaking VIA_HANDLER func when exception thrown in __call/... arg passing). (Nikita) . Fixed bug #69221 (Segmentation fault when using a generator in combination with an Iterator). (Nikita) . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability). (Stas) . Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions). (Stas) - Curl: . Implemented FR#69278 (HTTP2 support). (Masaki Kagaya) . Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence) - Date: . Export date_get_immutable_ce so that it can be used by extensions. (Derick Rethans) . Fixed bug #69336 (Issues with "last day of <monthname>"). (Derick Rethans) - Enchant: . Fixed bug #65406 (Enchant broker plugins are in the wrong place in windows builds). (Anatol) - Fileinfo: . Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault). (Anatol Belski) - Filter: . Fixed bug #69202 (FILTER_FLAG_STRIP_BACKTICK ignored unless other flags are used). (Jeff Welch) . Fixed bug #69203 (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127). (Jeff Welch) - Mbstring: . Fixed bug #68846 (False detection of CJK Unified Ideographs Extension E). (Masaki Kagaya) - OPCache . Fixed bug #68677 (Use After Free). (CVE-2015-1351) (Laruence) . Fixed bug #69281 (opcache_is_script_cached no longer works). (danack) - OpenSSL: . Fixed bug #67403 (Add signatureType to openssl_x509_parse). . Add a check for RAND_egd to allow compiling against LibreSSL (Leigh) - Phar: . Fixed bug #64343 (PharData::extractTo fails for tarball created by BSD tar). (Mike) . Fixed bug #64931 (phar_add_file is too restrictive on filename). (Mike) . Fixed bug #65467 (Call to undefined method cli_arg_typ_string). (Mike) . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing ".tar"). (Mike) . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas) . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode). (Stas) - Postgres: . Fixed bug #68741 (Null pointer dereference). (CVE-2015-1352) (Laruence) - SPL: . Fixed bug #69227 (Use after free in zval_scan caused by spl_object_storage_get_gc). (adam dot scarr at 99designs dot com) - SOAP: . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader (bisected, regression)). (thomas at shadowweb dot org, Laruence) - SQLITE: . Fixed bug #68760 (SQLITE segfaults if custom collator throws an exception). (Dan Ackroyd) . Fixed bug #69287 (Upgrade bundled sqlite to 3.8.8.3). (Anatol)
2015-04-17Update php54 to 5.4.40.taca1-2/+2
16 Apr 2015 PHP 5.4.40 - Apache2handler: . Fixed bug #69218 (potential remote code execution with apache 2.4 apache2handler). (Gerrit Venema) - Core: . Additional fix for bug #69152 (Type confusion vulnerability in exception::getTraceAsString). (Stas) . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability). (Stas) . Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions). (Stas) - cURL: . Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence) - Ereg: . Fixed bug #68740 (NULL Pointer Dereference). (Laruence) - Fileinfo: . Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault). (Anatol Belski) - GD: . Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (Remi) - Phar: . Fixed bug #68901 (use after free). (bugreports at internot dot info) . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas) . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode). (Stas) - Postgres: . Fixed bug #68741 (Null pointer deference) (CVE-2015-1352). (Xinchen Hui) - SOAP: . Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize() with SoapFault). (Dmitry) - Sqlite3: . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan)
2015-03-20Update php56 to 5.6.7, including security fix.taca1-2/+2
19 Mar 2015, PHP 5.6.7 - Core: . Fixed bug #69174 (leaks when unused inner class use traits precedence). (Laruence) . Fixed bug #69139 (Crash in gc_zval_possible_root on unserialize). (Laruence) . Fixed bug #69121 (Segfault in get_current_user when script owner is not in passwd with ZTS build). (dan at syneto dot net) . Fixed bug #65593 (Segfault when calling ob_start from output buffering callback). (Mike) . Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file not validated in memory.c). (nayana at ddproperty dot com) . Fixed bug #68166 (Exception with invalid character causes segv). (Rasmus) . Fixed bug #69141 (Missing arguments in reflection info for some builtin functions). (kostyantyn dot lysyy at oracle dot com) . Fixed bug #68976 (Use After Free Vulnerability in unserialize()). (Stas) . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options). (Anatol Belski) . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas) - CGI: . Fixed bug #69015 (php-cgi's getopt does not see $argv). (Laruence) - CLI: . Fixed bug #67741 (auto_prepend_file messes up __LINE__). (Reeze Xia) - cURL: . Fixed bug #69088 (PHP_MINIT_FUNCTION does not fully initialize cURL on Win32). (Grant Pannell) . Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported by libcurl. (Linus Unneback) - Ereg: . Fixed bug #69248 (heap overflow vulnerability in regcomp.c) (CVE-2015-2305). (Stas) - FPM: . Fixed bug #68822 (request time is reset too early). (honghu069 at 163 dot com) - ODBC: . Fixed bug #68964 (Allowed memory size exhausted with odbc_exec). (Anatol) - Opcache: . Fixed bug #69159 (Opcache causes problem when passing a variable variable to a function). (Dmitry, Laruence) . Fixed bug #69125 (Array numeric string as key). (Laruence) . Fixed bug #69038 (switch(SOMECONSTANT) misbehaves). (Laruence) - OpenSSL: . Fixed bug #68912 (Segmentation fault at openssl_spki_new). (Laruence) . Fixed bug #61285, #68329, #68046, #41631 (encrypted streams don't observe socket timeouts). (Brad Broerman) . Fixed bug #68920 (use strict peer_fingerprint input checks) (Daniel Lowrey) . Fixed bug #68879 (IP Address fields in subjectAltNames not used) (Daniel Lowrey) . Fixed bug #68265 (SAN match fails with trailing DNS dot) (Daniel Lowrey) . Fixed bug #67403 (Add signatureType to openssl_x509_parse) (Daniel Lowrey) . Fixed bug (#69195 Inconsistent stream crypto values across versions) (Daniel Lowrey) - pgsql: . Fixed bug #68638 (pg_update() fails to store infinite values). (william dot welter at 4linux dot com dot br, Laruence) - Readline: . Fixed bug #69054 (Null dereference in readline_(read|write)_history() without parameters). (Laruence) - SOAP: . Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()). (andrea dot palazzo at truel dot it, Laruence) - SPL: . Fixed bug #69108 ("Segmentation fault" when (de)serializing SplObjectStorage). (Laruence) . Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after calling getChildren()). (Julien) - ZIP: . Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap boundary) (CVE-2015-2331). (Stas)
2015-03-20Update php55 to 5.5.23, including security fix.taca1-2/+2
19 Mar 2015, PHP 5.5.23 - Core: . Fixed bug #69174 (leaks when unused inner class use traits precedence). (Laruence) . Fixed bug #69139 (Crash in gc_zval_possible_root on unserialize). (Laruence) . Fixed bug #69121 (Segfault in get_current_user when script owner is not in passwd with ZTS build). (dan at syneto dot net) . Fixed bug #65593 (Segfault when calling ob_start from output buffering callback). (Mike) . Fixed bug #69017 (Fail to push to the empty array with the constant value defined in class scope). (Laruence) . Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file not validated in memory.c). (nayana at ddproperty dot com) . Fixed bug #68166 (Exception with invalid character causes segv). (Rasmus) . Fixed bug #69141 (Missing arguments in reflection info for some builtin functions). (kostyantyn dot lysyy at oracle dot com) . Fixed bug #68976 (Use After Free Vulnerability in unserialize()). (Stas) . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options). (Anatol Belski) . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas) - CGI: . Fixed bug #69015 (php-cgi's getopt does not see $argv). (Laruence) - CLI: . Fixed bug #67741 (auto_prepend_file messes up __LINE__). (Reeze Xia) - cURL: . Fixed bug #69088 (PHP_MINIT_FUNCTION does not fully initialize cURL on Win32). (Grant Pannell) . Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported by libcurl. (Linus Unneback) - Ereg: . Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (Stas) - FPM: . Fixed bug #68822 (request time is reset too early). (honghu069 at 163 dot com) - ODBC: . Fixed bug #68964 (Allowed memory size exhausted with odbc_exec). (Anatol) - Opcache: . Fixed bug #69125 (Array numeric string as key). (Laruence) . Fixed bug #69038 (switch(SOMECONSTANT) misbehaves). (Laruence) - OpenSSL: . Fixed bugs #61285, #68329, #68046, #41631 (encrypted streams don't observe socket timeouts). (Brad Broerman) - pgsql: . Fixed bug #68638 (pg_update() fails to store infinite values). (william dot welter at 4linux dot com dot br, Laruence) - Readline: . Fixed bug #69054 (Null dereference in readline_(read|write)_history() without parameters). (Laruence) - SOAP: . Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()). (andrea dot palazzo at truel dot it, Laruence) - SPL: . Fixed bug #69108 ("Segmentation fault" when (de)serializing SplObjectStorage). (Laruence) . Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after calling getChildren()). (Julien) - ZIP: . Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap boundary) (CVE-2015-2331). (Stas)
2015-03-20Update php54 to 5.4.39, including securitfy fix.taca1-2/+2
19 Mar 2015 PHP 5.4.39 - Core: . Fixed bug #68976 (Use After Free Vulnerability in unserialize()). (Stas) . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options). (Anatol Belski) . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas) - Ereg: . Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (Stas) - SOAP: . Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()). (Dmitry) - ZIP: . Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap boundary). (Stas)
2015-03-16One more PHP_BASE_VERS related correction.taca1-2/+2
2015-03-16Fix problem by PHP_BASE_VERS related changes.taca1-2/+2
2015-03-15Drop php53 support.taca2-27/+11
2015-03-15Remove "used by lang/php53/Makefile.common" line.taca1-2/+1
2015-03-15Make PHP_BASE_VERS to initial php{53,54,55,56} version imported.taca1-5/+14
So, update of php{53,54,55,56} dose not change minimum version of depending php{53,54,55,56} any more. Since it relax minimum version, no need to bump PKGREVISION of each pacakge depending to php{53,54,55,56}. If a package requires specific (and later) versino of PHP, it should already specify such a version in dependency.
2015-02-20Update php56 to 5.6.6 (PHP 5.6.6).taca1-2/+2
19 Feb 2015, PHP 5.6.6 - Core: . Removed support for multi-line headers, as the are deprecated by RFC 7230. (Stas) . Fixed bug #67068 (getClosure returns somethings that's not a closure). (Danack at basereality dot com) . Fixed bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone). (CVE-2015-0273) (Stas) . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow). (Stas) . Fixed Bug #67988 (htmlspecialchars() does not respect default_charset specified by ini_set) (Yasuo) . Added NULL byte protection to exec, system and passthru. (Yasuo) - Dba: . Fixed bug #68711 (useless comparisons). (bugreports at internot dot info) - Enchant: . Fixed bug #68552 (heap buffer overflow in enchant_broker_request_dict()). (Antony) - Fileinfo: . Fixed bug #68827 (Double free with disabled ZMM). (Joshua Rogers) . Fixed bug #67647 (Bundled libmagic 5.17 does not detect quicktime files correctly). (Anatol) . Fixed bug #68731 (finfo_buffer doesn't extract the correct mime with some gifs). (Anatol) - FPM: . Fixed bug #66479 (Wrong response to FCGI_GET_VALUES). (Frank Stolle) . Fixed bug #68571 (core dump when webserver close the socket). (redfoxli069 at gmail dot com, Laruence) - JSON: . Fixed bug #50224 (json_encode() does not always encode a float as a float) by adding JSON_PRESERVE_ZERO_FRACTION. (Juan Basso) - LIBXML: . Fixed bug #64938 (libxml_disable_entity_loader setting is shared between threads). (Martin Jansen) - Mysqli: . Fixed bug #68114 (linker error on some OS X machines with fixed width decimal support) (Keyur Govande) . Fixed bug #68657 (Reading 4 byte floats with Mysqli and libmysqlclient has rounding errors) (Keyur Govande) - Opcache: . Fixed bug with try blocks being removed when extended_info opcode generation is turned on. (Laruence) - PDO_mysql: . Fixed bug #68750 (PDOMysql with mysqlnd does not allow the usage of named pipes). (steffenb198 at aol dot com) - Phar: . Fixed bug #68901 (use after free). (bugreports at internot dot info) - Pgsql: . Fixed Bug #65199 (pg_copy_from() modifies input array variable) (Yasuo) - Session: . Fixed bug #68941 (mod_files.sh is a bash-script) (bugzilla at ii.nl, Yasuo) . Fixed Bug #66623 (no EINTR check on flock) (Yasuo) . Fixed bug #68063 (Empty session IDs do still start sessions) (Yasuo) - Sqlite3: . Fixed bug #68260 (SQLite3Result::fetchArray declares wrong required_num_args). (Julien) - Standard: . Fixed bug #65272 (flock() out parameter not set correctly in windows). (Daniel Lowrey) . Fixed bug #69033 (Request may get env. variables from previous requests if PHP works as FastCGI). (Anatol) - Streams: . Fixed bug which caused call after final close on streams filter. (Bob)
2015-02-19Update php55 to 5.5.22 (PHP 5.5.22).taca1-2/+2
19 Feb 2015, PHP 5.5.22 - Core: . Fixed bug #67068 (getClosure returns somethings that's not a closure). (Danack at basereality dot com) . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow). (Stas) . Fixed bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone). (CVE-2015-0273) (Stas) . Added NULL byte protection to exec, system and passthru. (Yasuo) . Removed support for multi-line headers, as the are deprecated by RFC 7230. (Stas) - Date: . Fixed bug #45081 (strtotime incorrectly interprets SGT time zone). (Derick) - Dba: . Fixed bug #68711 (useless comparisons). (bugreports at internot dot info) - Enchant: . Fixed bug #6855 (heap buffer overflow in enchant_broker_request_dict()). (Antony) - Fileinfo: . Fixed bug #68827 (Double free with disabled ZMM). (Joshua Rogers) - FPM: . Fixed bug #66479 (Wrong response to FCGI_GET_VALUES). (Frank Stolle) . Fixed bug #68571 (core dump when webserver close the socket). (redfoxli069 at gmail dot com, Laruence) - Libxml: . Fixed bug #64938 (libxml_disable_entity_loader setting is shared between threads). (Martin Jansen) - OpenSSL: . Fixed bug #55618 (use case-insensitive cert name matching). (Daniel Lowrey) - PDO_mysql: . Fixed bug #68750 (PDOMysql with mysqlnd does not allow the usage of named pipes). (steffenb198@aol.com) - Phar: . Fixed bug #68901 (use after free). (bugreports at internot dot info) - Pgsql: . Fixed Bug #65199 'pg_copy_from() modifies input array variable). (Yasuo) - Sqlite3: . Fixed bug #68260 (SQLite3Result::fetchArray declares wrong required_num_args). (Julien) - Mysqli: . Fixed bug #68114 (linker error on some OS X machines with fixed width decimal support) (Keyur Govande) . Fixed bug #68657 (Reading 4 byte floats with Mysqli and libmysqlclient has rounding errors) (Keyur Govande) - Session: . Fixed bug #68941 (mod_files.sh is a bash-script) (bugzilla at ii.nl, Yasuo) . Fixed Bug #66623 (no EINTR check on flock) (Yasuo) . Fixed bug #68063 (Empty session IDs do still start sessions) (Yasuo) - Standard: . Fixed bug #65272 (flock() out parameter not set correctly in windows). (Daniel Lowrey) . Fixed bug #69033 (Request may get env. variables from previous requests if PHP works as FastCGI) - Streams: . Fixed bug which caused call after final close on streams filter. (Bob)
2015-02-19Forgot to commit with php54 update.taca1-2/+2
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-16 07:30:35 +0000