Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:76709
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain zend.com designates 209.85.219.44 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH-PCH7=T0t6WoFWj9TsbdEBj3RcoDFECNWe3dLkcQyHyP-Vvg@mail.gmail.com>
References: <CAH-PCH68rm=KLwR93RJsFFeaAjXX-no2sDFNpvBwozAc-vHOgQ@mail.gmail.com>
	<CAH-PCH7=T0t6WoFWj9TsbdEBj3RcoDFECNWe3dLkcQyHyP-Vvg@mail.gmail.com>
Date: Wed, 20 Aug 2014 01:36:07 +0300
Message-ID: <CAPJnDK1p3=9eAmoXwB7dxhmDa+Au+60n8668AD5EpwET7ZbLzA@mail.gmail.com>
To: Ferenc Kovacs <tyra3l@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e011604200e99570501031d51
Subject: Re: [PHP-DEV] Re: 5.6.0 final is near
From: lior.k@zend.com (Lior Kaplan)

--089e011604200e99570501031d51
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Please make sure these security fixes are included:

fileinfo:
Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587)

gd:
Fixed bug #67730 (Null byte injection possible with imagexxx functions).
(CVE-2014-5120)

Thanks,

Kaplan


On Mon, Aug 18, 2014 at 5:46 PM, Ferenc Kovacs <tyra3l@gmail.com> wrote:

> On Sun, Aug 17, 2014 at 11:25 AM, Ferenc Kovacs <tyra3l@gmail.com> wrote:
>
> > Hi,
> >
> > I'm planning to release 5.6.0 from RC4 if nothing serious comes up, so
> > this is just a heads-up: if you think that there is some fix, which
> should
> > make into the 5.6.0 final (which isn't in RC4) or if you think that the=
re
> > is some blocker issue which should be solved before the 5.6.0 final
> > release, please drop me an email just to be sure.
> >
> > Thanks!
> >
> > --
> > Ferenc Kov=C3=A1cs
> > @Tyr43l - http://tyrael.hu
> >
>
> Hi,
>
> just to clarify:
> if no blocker issue is reported from php-5.6.0RC4, then we won't have
> another RC, but php-5.6.0 (final) will be tagged using PHP-5.6.0RC4 as it
> base, and maybe some commits cherry-picked (security fixes for example, o=
r
> changes with low impact like NEWS/UPGRADING/test fixes) on top of it.
> so commits in the PHP-5.6 branch after the RC4 tagging won't be in the
> final by default, only if you can convince me that we need that.
>
> --
> Ferenc Kov=C3=A1cs
> @Tyr43l - http://tyrael.hu
>

--089e011604200e99570501031d51--