# PHP 4.3.10 & 5.0.3 Released!

- Thread: https://externals.io/message/14077
- Original archive: https://news-web.php.net/php.internals/14077
- Started by Ilia Alshanetsky on 2004-12-15T21:07:29+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #14077 — Ilia Alshanetsky — 2004-12-15T21:07:29+00:00

URL: https://externals.io/message/14077#14077

PHP Development Team would like to announce the immediate release of PHP
4.3.10 and 5.0.3. These are maintenance releases that in addition to 
non-critical bug fixes address several very serious security issues.

These include the following:

CAN-2004-1018 - shmop_write() out of bounds memory write access.
CAN-2004-1018 - integer overflow/underflow in `pack()` and `unpack()` functions.
CAN-2004-1019 - possible information disclosure, double free and 
negative reference index array underflow in deserialization code.
CAN-2004-1020 - addslashes not escaping \0 correctly.
CAN-2004-1063 - safe_mode execution directory bypass.
CAN-2004-1064 - arbitrary file access through path truncation.
CAN-2004-1065 - `exif_read_data()` overflow on long sectionname.
magic_quotes_gpc could lead to one level directory traversal with file 
uploads.

All Users of PHP are strongly encouraged to upgrade to one of these 
releases as soon as possible.

Aside from the above mentioned issues the releases include the
following important fixes:

* Possible crash inside `ftp_get()`.
* `get_current_user()` crashes on Windows.
* Possible crash in ctype_digit on large numbers.
* Crash when parsing ?getvariable[][.
* Possible crash in the `curl_getinfo()` function.
* Double free when openssl_csr_new fails.
* Crash when using unknown/unsupported session.save_handler and/or 
session.serialize_handler.
* Prevent infinite recursion in url redirection.
* Ensure that temporary files created by GD are removed.
* Crash in `fgetcsv()` with negative length. (PHP 4 only)
* Improved performance of the foreach() construct. (PHP 4 only)
* Improved number handling on non-English locales.

PHP Development Team would like to thank all the people who have
identified the security faults in PHP and helped us to address them.


PHP Development Team

---

## #14082 — Alan Knowles — 2004-12-15T23:12:38+00:00

URL: https://externals.io/message/14077#14082 · In reply to: #14077

Since all the CAN references are broken at present - this documents the 
bugs.
http://groups-beta.google.com/group/muc.lists.bugtraq/browse_thread/thread/7c7ae6f328f28913?tvc=2&q=CAN-2004-1064

Regards
Alan

Ilia Alshanetsky wrote:

> PHP Development Team would like to announce the immediate release of PHP
> 4.3.10 and 5.0.3. These are maintenance releases that in addition to 
> non-critical bug fixes address several very serious security issues.
>
> These include the following:
>
> CAN-2004-1018 - shmop_write() out of bounds memory write access.
> CAN-2004-1018 - integer overflow/underflow in `pack()` and `unpack()` 
> functions.
> CAN-2004-1019 - possible information disclosure, double free and 
> negative reference index array underflow in deserialization code.
> CAN-2004-1020 - addslashes not escaping \0 correctly.
> CAN-2004-1063 - safe_mode execution directory bypass.
> CAN-2004-1064 - arbitrary file access through path truncation.
> CAN-2004-1065 - `exif_read_data()` overflow on long sectionname.
> magic_quotes_gpc could lead to one level directory traversal with file 
> uploads.
>
> All Users of PHP are strongly encouraged to upgrade to one of these 
> releases as soon as possible.
>
> Aside from the above mentioned issues the releases include the
> following important fixes:
>
> * Possible crash inside `ftp_get()`.
> * `get_current_user()` crashes on Windows.
> * Possible crash in ctype_digit on large numbers.
> * Crash when parsing ?getvariable[][.
> * Possible crash in the `curl_getinfo()` function.
> * Double free when openssl_csr_new fails.
> * Crash when using unknown/unsupported session.save_handler and/or 
> session.serialize_handler.
> * Prevent infinite recursion in url redirection.
> * Ensure that temporary files created by GD are removed.
> * Crash in `fgetcsv()` with negative length. (PHP 4 only)
> * Improved performance of the foreach() construct. (PHP 4 only)
> * Improved number handling on non-English locales.
>
> PHP Development Team would like to thank all the people who have
> identified the security faults in PHP and helped us to address them.
>
>
> PHP Development Team