Newsgroups: php.announce,php.internals
Path: news.php.net
Xref: news.php.net php.announce:55 php.internals:15708
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <424C709E.6000408@prohost.org>
Date: Thu, 31 Mar 2005 16:50:22 -0500
User-Agent: Mozilla Thunderbird 1.0 - [MOOX M3] (Windows/20041208)
MIME-Version: 1.0
To: php-announce@lists.php.net, 
	PHP Internals List <internals@lists.php.net>,
	general@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: PHP 4.3.11 & 5.0.4 Released!
From: ilia@prohost.org (Ilia Alshanetsky)

The PHP Development Team would like to announce the immediate release of 
PHP 4.3.11 and 5.0.4.  These are maintenance releases that in addition 
to fixing over 70 non-critical bugs, address several security issues. 
The addressed security issues include fixes to the exif and fbsql 
extensions, as well as fixes to unserialize(), swf_definepoly() and 
getimagesize().

All users of PHP are strongly encouraged to upgrade to this release.

Aside from the above mentioned issues this release includes the 
following important fixes:

* Crash in bzopen() if supplied path to non-existent file.
* DOM crashing when attribute appended to Document.
* unserialize() float problem on non-English locales.
* Crash in msg_send() when non-string is stored without being serialized.
* Possible infinite loop in imap_mail_compose().
* Fixed crash in chunk_split(), when chunklen > strlen.
* session_set_save_handler crashes PHP when supplied non-existent object 
reference.
* Memory leak in zend_language_scanner.c.
* Compile failures of zend_strtod.c.
* Fixed crash in overloaded objects & overload() function.
* cURL functions bypass open_basedir.

The PHP Development Team would like to thank all the people who have 
identified the security faults in PHP and helped us address them.