Skip to content

Commit 7786bbb

Browse files
johannacjohannac
authored
Merge pull request #1 from php/master
Pull from upstream
2 parents 9d8f9df + 842227e commit 7786bbb

File tree

10 files changed

+261
-40
lines changed

10 files changed

+261
-40
lines changed

‎.gitmodules

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
[submodule "distributions"]
22
path = distributions
3-
url = https://git.php.net/repository/web/php-distributions.git
3+
url = git@git.php.net:/web/php-distributions.git

‎ChangeLog-5.php

Lines changed: 106 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,103 @@
77
?>
88

99
<h1>PHP 5 ChangeLog</h1>
10+
<section class="version" id="5.6.26"><!-- {{{ 5.6.26 -->
11+
<h3>Version 5.6.26</h3>
12+
<b><?php release_date('15-Sep-2016'); ?></b>
13+
<ul><li>Core:
14+
<ul>
15+
<li><?php bugfix(72907); ?> (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260)).</li>
16+
</ul></li>
17+
<li>Dba:
18+
<ul>
19+
<li><?php bugfix(71514); ?> (Bad dba_replace condition because of wrong API usage).</li>
20+
<li><?php bugfix(70825); ?> (Cannot fetch multiple values with group in ini file).</li>
21+
</ul></li>
22+
<li>EXIF:
23+
<ul>
24+
<li><?php bugfix(72926); ?> (Uninitialized Thumbail Data Leads To Memory Leakage in exif_process_IFD_in_TIFF).</li>
25+
</ul></li>
26+
<li>FTP:
27+
<ul>
28+
<li><?php bugfix(70195); ?> (Cannot upload file using ftp_put to FTPES with require_ssl_reuse).</li>
29+
</ul></li>
30+
<li>GD:
31+
<ul>
32+
<li><?php bugfix(66005); ?> (imagecopy does not support 1bit transparency on truecolor images).</li>
33+
<li><?php bugfix(72913); ?> (imagecopy() loses single-color transparency on palette images).</li>
34+
<li><?php bugfix(68716); ?> (possible resource leaks in _php_image_convert()).</li>
35+
</ul></li>
36+
<li>Intl:
37+
<ul>
38+
<li><?php bugfix(73007); ?> (add locale length check). (CVE-2016-7416)</li>
39+
</ul></li>
40+
<li>JSON:
41+
<ul>
42+
<li><?php bugfix(72787); ?> (json_decode reads out of bounds).</li>
43+
</ul></li>
44+
<li>mbstring:
45+
<ul>
46+
<li><?php bugfix(66797); ?> (mb_substr only takes 32-bit signed integer).</li>
47+
<li><?php bugfix(72910); ?> (Out of bounds heap read in mbc_to_code() / triggered by mb_ereg_match()).</li>
48+
</ul></li>
49+
<li>MSSQL:
50+
<ul>
51+
<li><?php bugfix(72039); ?> (Use of uninitialised value on mssql_guid_string).</li>
52+
</ul></li>
53+
<li>Mysqlnd:
54+
<ul>
55+
<li><?php bugfix(72293); ?> (Heap overflow in mysqlnd related to BIT fields). (CVE-2016-7412)</li>
56+
</ul></li>
57+
<li>PDO:
58+
<ul>
59+
<li><?php bugfix(60665); ?> (call to empty() on NULL result using PDO::FETCH_LAZY returns false).</li>
60+
</ul></li>
61+
<li>PDO_pgsql:
62+
<ul>
63+
<li>Implemented FR <?php bugl(72633); ?> (Postgres PDO lastInsertId() should work without specifying a sequence).</li>
64+
<li><?php bugfix(72759); ?> (Regression in pgo_pgsql).</li>
65+
</ul></li>
66+
<li>Phar:
67+
<ul>
68+
<li><?php bugfix(72928); ?> (Out of bound when verify signature of zip phar in phar_parse_zipfile). (CVE-2016-7414)</li>
69+
<li><?php bugfix(73035); ?> (Out of bound when verify signature of tar phar in phar_parse_tarfile).</li>
70+
</ul></li>
71+
<li>SPL:
72+
<ul>
73+
<li><?php bugfix(73029); ?> (Missing type check when unserializing SplArray). (CVE-2016-7417)</li>
74+
</ul></li>
75+
<li>Standard:
76+
<ul>
77+
<li><?php bugfix(72823); ?> (strtr out-of-bound access).</li>
78+
<li><?php bugfix(72278); ?> (getimagesize returning FALSE on valid jpg).</li>
79+
<li><?php bugfix(65550); ?> (get_browser() incorrectly parses entries with "+" sign).</li>
80+
<li><?php bugfix(71882); ?> (Negative ftruncate() on php://memory exhausts memory).</li>
81+
<li><?php bugfix(73011); ?> (integer overflow in fgets cause heap corruption).</li>
82+
<li><?php bugfix(73017); ?> (memory corruption in wordwrap function).</li>
83+
<li><?php bugfix(73045); ?> (integer overflow in fgetcsv caused heap corruption).</li>
84+
<li><?php bugfix(73052); ?> (Memory Corruption in During Deserialized-object Destruction). (CVE-2016-7411)</li>
85+
</ul></li>
86+
<li>Streams:
87+
<ul>
88+
<li><?php bugfix(72853); ?> (stream_set_blocking doesn't work).</li>
89+
</ul></li>
90+
<li>Wddx:
91+
<ul>
92+
<li><?php bugfix(72860); ?> (wddx_deserialize use-after-free). (CVE-2016-7413)</li>
93+
<li><?php bugfix(73065); ?> (Out-Of-Bounds Read in php_wddx_push_element). (CVE-2016-7418)</li>
94+
</ul></li>
95+
<li>XML:
96+
<ul>
97+
<li><?php bugfix(72085); ?> (SEGV on unknown address zif_xml_parse).</li>
98+
<li><?php bugfix(72927); ?> (integer overflow in xml_utf8_encode).</li>
99+
</ul></li>
100+
<li>ZIP:
101+
<ul>
102+
<li><?php bugfix(68302); ?> (impossible to compile php with zip support).</li>
103+
</ul></li>
104+
</ul>
105+
<!-- }}} --></section>
106+
10107
<section class="version" id="5.6.25"><!-- {{{ 5.6.25 -->
11108
<h3>Version 5.6.25</h3>
12109
<b><?php release_date('18-Aug-2016'); ?></b>
@@ -17,8 +114,8 @@
17114
<li><?php bugfix(72581); ?> (previous property undefined in Exception after deserialization).</li>
18115
<li>Implemented FR <?php bugl(72614); ?> (Support "nmake test" on building extensions by phpize).</li>
19116
<li><?php bugfix(72641); ?> (phpize (on Windows) ignores PHP_PREFIX).</li>
20-
<li><?php bugfix(72663); ?> (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization).</li>
21-
<li><?php bugfix(72681); ?> (PHP Session Data Injection Vulnerability).</li>
117+
<li><?php bugfix(72663); ?> (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization). (CVE-2016-7124)</li>
118+
<li><?php bugfix(72681); ?> (PHP Session Data Injection Vulnerability). (CVE-2016-7125)</li>
22119
</ul></li>
23120
<li>Bz2:
24121
<ul>
@@ -45,7 +142,7 @@
45142
</ul></li>
46143
<li>EXIF:
47144
<ul>
48-
<li><?php bugfix(72627); ?> (Memory Leakage In exif_process_IFD_in_TIFF).</li>
145+
<li><?php bugfix(72627); ?> (Memory Leakage In exif_process_IFD_in_TIFF). (CVE-2016-7128)</li>
49146
<li><?php bugfix(72735); ?> (Samsung picture thumb not read (zero size)).</li>
50147
</ul></li>
51148
<li>Filter:
@@ -64,9 +161,9 @@
64161
<li><?php bugfix(70315); ?> (500 Server Error but page is fully rendered).</li>
65162
<li><?php bugfix(72596); ?> (imagetypes function won't advertise WEBP support).</li>
66163
<li><?php bugfix(72604); ?> (imagearc() ignores thickness for full arcs).</li>
67-
<li><?php bugfix(72697); ?> (select_colors write out-of-bounds).</li>
164+
<li><?php bugfix(72697); ?> (select_colors write out-of-bounds). (CVE-2016-7126)</li>
68165
<li><?php bugfix(72709); ?> (imagesetstyle() causes OOB read for empty $styles).</li>
69-
<li><?php bugfix(72730); ?> (imagegammacorrect allows arbitrary write access).</li>
166+
<li><?php bugfix(72730); ?> (imagegammacorrect allows arbitrary write access). (CVE-2016-7127)</li>
70167
</ul></li>
71168
<li>Intl:
72169
<ul>
@@ -125,10 +222,10 @@
125222
<li>Wddx:
126223
<ul>
127224
<li><?php bugfix(72142); ?> (WDDX Packet Injection Vulnerability in wddx_serialize_value()).</li>
128-
<li><?php bugfix(72749); ?> (wddx_deserialize allows illegal memory access) (Stas)</li>
129-
<li><?php bugfix(72750); ?> (wddx_deserialize null dereference).</li>
130-
<li><?php bugfix(72790); ?> (wddx_deserialize null dereference with invalid xml).</li>
131-
<li><?php bugfix(72799); ?> (wddx_deserialize null dereference in php_wddx_pop_element).</li>
225+
<li><?php bugfix(72749); ?> (wddx_deserialize allows illegal memory access). (CVE-2016-7129)</li>
226+
<li><?php bugfix(72750); ?> (wddx_deserialize null dereference). (CVE-2016-7130)</li>
227+
<li><?php bugfix(72790); ?> (wddx_deserialize null dereference with invalid xml). (CVE-2016-7131)</li>
228+
<li><?php bugfix(72799); ?> (wddx_deserialize null dereference in php_wddx_pop_element). (CVE-2016-7132)</li>
132229
</ul></li>
133230
</ul>
134231
<!-- }}} --></section>

‎ChangeLog-7.php

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -50,11 +50,11 @@
5050
<li>Intl:
5151
<ul>
5252
<li><?php bugfix(65732); ?> (grapheme_*() is not Unicode compliant on CR LF sequence).</li>
53-
<li><?php bugfix(73007); ?> (add locale length check).</li>
53+
<li><?php bugfix(73007); ?> (add locale length check). (CVE-2016-7416)</li>
5454
</ul></li>
5555
<li>Mysqlnd:
5656
<ul>
57-
<li><?php bugfix(72293); ?> (Heap overflow in mysqlnd related to BIT fields).</li>
57+
<li><?php bugfix(72293); ?> (Heap overflow in mysqlnd related to BIT fields). (CVE-2016-7412)</li>
5858
</ul></li>
5959
<li>OCI8:
6060
<ul>
@@ -82,7 +82,7 @@
8282
</ul></li>
8383
<li>Phar:
8484
<ul>
85-
<li><?php bugfix(72928); ?> (Out of bound when verify signature of zip phar in phar_parse_zipfile).</li>
85+
<li><?php bugfix(72928); ?> (Out of bound when verify signature of zip phar in phar_parse_zipfile). (CVE-2016-7414)</li>
8686
<li><?php bugfix(73035); ?> (Out of bound when verify signature of tar phar in phar_parse_tarfile).</li>
8787
</ul></li>
8888
<li>Reflection:
@@ -101,7 +101,7 @@
101101
</ul></li>
102102
<li>SPL:
103103
<ul>
104-
<li><?php bugfix(73029); ?> (Missing type check when unserializing SplArray).</li>
104+
<li><?php bugfix(73029); ?> (Missing type check when unserializing SplArray). (CVE-2016-7417)</li>
105105
</ul></li>
106106
<li>Standard:
107107
<ul>
@@ -123,16 +123,16 @@
123123
<ul>
124124
<li><?php bugfix(72858); ?> (shm_attach null dereference).</li>
125125
</ul></li>
126+
<li>Wddx:
127+
<ul>
128+
<li><?php bugfix(72860); ?> (wddx_deserialize use-after-free). (CVE-2016-7413)</li>
129+
<li><?php bugfix(73065); ?> (Out-Of-Bounds Read in php_wddx_push_element). (CVE-2016-7418)</li>
130+
</ul></li>
126131
<li>XML:
127132
<ul>
128133
<li><?php bugfix(72085); ?> (SEGV on unknown address zif_xml_parse).</li>
129134
<li><?php bugfix(72714); ?> (_xml_startElementHandler() segmentation fault).</li>
130135
</ul></li>
131-
<li>Wddx:
132-
<ul>
133-
<li><?php bugfix(72860); ?> (wddx_deserialize use-after-free).</li>
134-
<li><?php bugfix(73065); ?> (Out-Of-Bounds Read in php_wddx_push_element).</li>
135-
</ul></li>
136136
<li>ZIP:
137137
<ul>
138138
<li><?php bugfix(68302); ?> (impossible to compile php with zip support).</li>
@@ -155,10 +155,10 @@
155155
<li>Implemented FR <?php bugl(72614); ?> (Support "nmake test" on building extensions by phpize).</li>
156156
<li><?php bugfix(72641); ?> (phpize (on Windows) ignores PHP_PREFIX).</li>
157157
<li>Fixed potential segfault in object storage freeing in shutdown sequence.</li>
158-
<li><?php bugfix(72663); ?> (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization).</li>
159-
<li><?php bugfix(72681); ?> (PHP Session Data Injection Vulnerability).</li>
158+
<li><?php bugfix(72663); ?> (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization). (CVE-2016-7124)</li>
159+
<li><?php bugfix(72681); ?> (PHP Session Data Injection Vulnerability). (CVE-2016-7125)</li>
160160
<li><?php bugfix(72683); ?> (getmxrr broken).</li>
161-
<li><?php bugfix(72742); ?> (memory allocator fails to realloc small block to large one).</li>
161+
<li><?php bugfix(72742); ?> (memory allocator fails to realloc small block to large one). (CVE-2016-7133)</li>
162162
</ul></li>
163163
<li>Bz2:
164164
<ul>
@@ -177,7 +177,7 @@
177177
<ul>
178178
<li><?php bugfix(71709); ?> (curl_setopt segfault with empty CURLOPT_HTTPHEADER).</li>
179179
<li><?php bugfix(71929); ?> (CURLINFO_CERTINFO data parsing error).</li>
180-
<li><?php bugfix(72674); ?> (Heap overflow in curl_escape).</li>
180+
<li><?php bugfix(72674); ?> (Heap overflow in curl_escape). (CVE-2016-7134)</li>
181181
</ul></li>
182182
<li>DOM:
183183
<ul>
@@ -186,7 +186,7 @@
186186
<li>EXIF:
187187
<ul>
188188
<li><?php bugfix(72735); ?> (Samsung picture thumb not read (zero size)).</li>
189-
<li><?php bugfix(72627); ?> (Memory Leakage In exif_process_IFD_in_TIFF).</li>
189+
<li><?php bugfix(72627); ?> (Memory Leakage In exif_process_IFD_in_TIFF). (CVE-2016-7128)</li>
190190
</ul></li>
191191
<li>Filter:
192192
<ul>
@@ -204,8 +204,8 @@
204204
<li><?php bugfix(43828); ?> (broken transparency of imagearc for truecolor in blendingmode).</li>
205205
<li><?php bugfix(66555); ?> (Always false condition in ext/gd/libgd/gdkanji.c).</li>
206206
<li><?php bugfix(68712); ?> (suspicious if-else statements).</li>
207-
<li><?php bugfix(72697); ?> (select_colors write out-of-bounds).</li>
208-
<li><?php bugfix(72730); ?> (imagegammacorrect allows arbitrary write access).</li>
207+
<li><?php bugfix(72697); ?> (select_colors write out-of-bounds). (CVE-2016-7126)</li>
208+
<li><?php bugfix(72730); ?> (imagegammacorrect allows arbitrary write access). (CVE-2016-7127)</li>
209209
</ul></li>
210210
<li>Intl:
211211
<ul>
@@ -283,10 +283,10 @@
283283
<ul>
284284
<li><?php bugfix(72564); ?> (boolean always deserialized as "true").</li>
285285
<li><?php bugfix(72142); ?> (WDDX Packet Injection Vulnerability in wddx_serialize_value()).</li>
286-
<li><?php bugfix(72749); ?> (wddx_deserialize allows illegal memory access) (Stas)</li>
287-
<li><?php bugfix(72750); ?> (wddx_deserialize null dereference).</li>
288-
<li><?php bugfix(72790); ?> (wddx_deserialize null dereference with invalid xml).</li>
289-
<li><?php bugfix(72799); ?> (wddx_deserialize null dereference in php_wddx_pop_element).</li>
286+
<li><?php bugfix(72749); ?> (wddx_deserialize allows illegal memory access). (CVE-2016-7129)</li>
287+
<li><?php bugfix(72750); ?> (wddx_deserialize null dereference). (CVE-2016-7130)</li>
288+
<li><?php bugfix(72790); ?> (wddx_deserialize null dereference with invalid xml). (CVE-2016-7131)</li>
289+
<li><?php bugfix(72799); ?> (wddx_deserialize null dereference in php_wddx_pop_element). (CVE-2016-7132)</li>
290290
</ul></li>
291291
<li>Zip:
292292
<ul>

‎archive/archive.xml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99
<uri>http://php.net/contact</uri>
1010
<email>[email protected]</email>
1111
</author>
12+
<xi:include href="entries/2016-09-16-2.xml"/>
13+
<xi:include href="entries/2016-09-16-1.xml"/>
1214
<xi:include href="entries/2016-09-15-1.xml"/>
1315
<xi:include href="entries/2016-09-09-1.xml"/>
1416
<xi:include href="entries/2016-09-06-1.xml"/>

‎archive/entries/2016-09-16-1.xml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<entry xmlns="http://www.w3.org/2005/Atom">
3+
<title>PHP 5.6.26 is released</title>
4+
<id>http://php.net/archive/2016.php#id2016-09-16-1</id>
5+
<published>2016-09-16T06:39:08+00:00</published>
6+
<updated>2016-09-16T06:39:08+00:00</updated>
7+
<category term="frontpage" label="PHP.net frontpage news"/>
8+
<category term="releases" label="New PHP release"/>
9+
<link href="http://php.net/index.php#id2016-09-16-1" rel="alternate" type="text/html"/>
10+
<link href="http://php.net/archive/2016.php#id2016-09-16-1" rel="via" type="text/html"/>
11+
<content type="xhtml">
12+
<div xmlns="http://www.w3.org/1999/xhtml">
13+
<p>The PHP development team announces the immediate availability of PHP
14+
5.6.26. This is a security release. Several security bugs were fixed in
15+
this release.
16+
17+
All PHP 5.6 users are encouraged to upgrade to this version.</p>
18+
19+
<p>For source downloads of PHP 5.6.26 please visit our <a href="http://www.php.net/downloads.php">downloads page</a>,
20+
Windows source and binaries can be found on <a href="http://windows.php.net/download/">windows.php.net/download/</a>.
21+
The list of changes is recorded in the <a href="http://www.php.net/ChangeLog-5.php#5.6.26">ChangeLog</a>.
22+
</p>
23+
</div>
24+
</content>
25+
</entry>

‎archive/entries/2016-09-16-2.xml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<entry xmlns="http://www.w3.org/2005/Atom">
3+
<title>PHP 7.1.0 Release Candidate 2 Released</title>
4+
<id>http://php.net/archive/2016.php#id2016-09-16-2</id>
5+
<published>2016-09-16T23:33:30+00:00</published>
6+
<updated>2016-09-16T23:33:30+00:00</updated>
7+
<category term="frontpage" label="PHP.net frontpage news"/>
8+
<category term="releases" label="New PHP release"/>
9+
<link href="http://php.net/index.php#id2016-09-16-2" rel="alternate" type="text/html"/>
10+
<link href="http://php.net/archive/2016.php#id2016-09-16-2" rel="via" type="text/html"/>
11+
<content type="xhtml">
12+
<div xmlns="http://www.w3.org/1999/xhtml">
13+
<p>
14+
The PHP development team announces the immediate availability of PHP 7.1.0 Release Candidate 2. This release is the second release candidate for 7.1.0. All users of PHP are encouraged to test this version carefully, and report any bugs and incompatibilities in the bug tracking system.
15+
</p>
16+
17+
<p>
18+
<strong>THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT IN PRODUCTION!</strong>
19+
</p>
20+
21+
<p>
22+
For more information on the new features and other changes, you can read the <a href="https://github.com/php/php-src/blob/php-7.1.0RC2/NEWS">NEWS</a> file,
23+
or the <a href="https://github.com/php/php-src/blob/php-7.1.0RC2/UPGRADING">UPGRADING</a> file for a complete list of upgrading notes. These files can also be found in the release archive.
24+
</p>
25+
26+
<p>
27+
For source downloads of PHP 7.1.0 Release Candidate 2 please visit the <a href="https://downloads.php.net/~davey/">download</a> page, Windows sources and binaries can be found on <a href="http://windows.php.net/qa/">windows.php.net/qa/</a>.
28+
</p>
29+
30+
<p>
31+
The third release candidate will be released on the 29th of September. You can also read the full list of planned releases on <a href="https://wiki.php.net/todo/php71">our wiki</a>.
32+
</p>
33+
34+
<p>
35+
Thank you for helping us make PHP better.
36+
</p>
37+
</div>
38+
</content>
39+
</entry>

‎distributions

Submodule distributions updated from 5c74aba to f53639a

‎include/releases.inc

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,42 @@ $OLDRELEASES = array (
401401
),
402402
5 =>
403403
array (
404+
'5.6.25' =>
405+
array (
406+
'announcement' =>
407+
array (
408+
'English' => '/releases/5_6_25.php',
409+
),
410+
'source' =>
411+
array (
412+
0 =>
413+
array (
414+
'filename' => 'php-5.6.25.tar.bz2',
415+
'name' => 'PHP 5.6.25 (tar.bz2)',
416+
'md5' => 'f63b9956c25f1ae0433015a80b44224c',
417+
'sha256' => '58ce6032aced7f3e42ced492bd9820e5b3f2a3cd3ef71429aa92fd7b3eb18dde',
418+
'date' => '18 Aug 2016',
419+
),
420+
1 =>
421+
array (
422+
'filename' => 'php-5.6.25.tar.gz',
423+
'name' => 'PHP 5.6.25 (tar.gz)',
424+
'md5' => '75f90f5bd7d0076a0dcc5f3205ce260e',
425+
'sha256' => '733f1c811d51c2d4031a0c058dc94d09d03858d781ca2eb2cce78853bc76db58',
426+
'date' => '18 Aug 2016',
427+
),
428+
2 =>
429+
array (
430+
'filename' => 'php-5.6.25.tar.xz',
431+
'name' => 'PHP 5.6.25 (tar.xz)',
432+
'md5' => '81cb8c0de0d0b714587edbd27a2a75bb',
433+
'sha256' => '7535cd6e20040ccec4594cc386c6f15c3f2c88f24163294a31068cf7dfe7f644',
434+
'date' => '18 Aug 2016',
435+
),
436+
),
437+
'date' => '18 Aug 2016',
438+
'museum' => false,
439+
),
404440
'5.6.24' =>
405441
array (
406442
'announcement' =>

0 commit comments

Comments
 (0)