Newsgroups: php.general,php.internals,php.announce
Path: news.php.net
Xref: news.php.net php.general:311904 php.internals:51719 php.announce:82
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: unknown (pb1.pair.com: domain php.net does not designate 217.114.211.66 as permitted sender)
To: php-announce <php-announce@lists.php.net>
Cc: php-general@lists.php.net, internals@lists.php.net
Content-Type: text/plain; charset="UTF-8"
Organization: php.net
Date: Thu, 17 Mar 2011 16:29:16 +0100
Message-ID: <1300375756.2006.41.camel@guybrush>
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Subject: PHP 5.3.6 Released!
From: johannes@php.net (Johannes =?ISO-8859-1?Q?Schl=FCter?=)

The PHP development team would like to announce the immediate
availability of PHP 5.3.6. This release focuses on improving the
stability of the PHP 5.3.x branch with over 60 bug fixes, some of which
are security related.

Security Enhancements and Fixes in PHP 5.3.6:

    * Enforce security in the fastcgi protocol parsing with fpm SAPI.
    * Fixed bug #54247 (format-string vulnerability on Phar).
      (CVE-2011-1153)
    * Fixed bug #54193 (Integer overflow in shmop_read()).
      (CVE-2011-1092)
    * Fixed bug #54055 (buffer overrun with high values for precision
      ini setting).
    * Fixed bug #54002 (crash on crafted tag in exif). (CVE-2011-0708)
    * Fixed bug #53885 (ZipArchive segfault with FL_UNCHANGED on empty
      archive). (CVE-2011-0421)

Key enhancements in PHP 5.3.6 include:

    * Upgraded bundled Sqlite3 to version 3.7.4.
    * Upgraded bundled PCRE to version 8.11.
    * Added ability to connect to HTTPS sites through proxy with basic
      authentication using stream_context/http/header/Proxy-Authorization.
    * Added options to debug backtrace functions.
    * Changed default value of ini directive serialize_precision from
      100 to 17.
    * Fixed Bug #53971 (isset() and empty() produce apparently spurious
      runtime error).
    * Fixed Bug #53958 (Closures can't 'use' shared variables by value
      and by reference).
    * Fixed bug #53577 (Regression introduced in 5.3.4 in open_basedir
      with a trailing forward slash).
    * Over 60 other bug fixes.

Windows users: please mind that we do no longer provide builds created
with Visual Studio C++ 6. It is impossible to maintain a high quality
and safe build of PHP for Windows using this unmaintained compiler.

For Apache SAPIs (php5_apache2_2.dll), be sure that you use a Visual
Studio C++ 9 version of Apache. We recommend the PHP builds as provided
by ApacheLounge. For any other SAPI (CLI, FastCGI via mod_fcgi, FastCGI
with IIS or other FastCGI capable server), everything works as before.
Third party extension providers must rebuild their extensions to make
them compatible and loadable with the Visual Studio C++9 builds that we
no longer provide.

All PHP users should note that the PHP 5.2 series is NOT supported
anymore. All users are strongly encouraged to upgrade to PHP 5.3.6.

For a full list of changes in PHP 5.3.6, see the ChangeLog
<http://php.net/ChangeLog-5.php#5.3.6>. For source downloads please
visit our downloads page <http://php.net/downloads.php>, Windows
binaries can be found on <http://windows.php.net/download/>. 

Johannes Schlüter
PHP 5.3 Release Master