The PHP development team would like to announce the immediate
availability of PHP 5.2.2 and availability of PHP 4.4.7. These releases
are major stability and security enhancements of the 5.x and 4.4.x
branches, and all users are strongly encouraged to upgrade to it as soon
as possible. Further details about the PHP 5.2.2 release can be found in
the release announcement for 5.2.2 (http://
www.php.net/releases/5_2_2.php). Details about the PHP 4.4.7 release can
be found in the release announcement for 4.4.7 (http://
www.php.net/releases/4_4_7.php).
Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:
- Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan
Fratric) - Fixed asciiz byte truncation inside
mail()(MOPB-33 by Stefan Esser) - Fixed a bug in
mb_parse_str()that can be used to activate
register_globals (MOPB-26 by Stefan Esser) - Fixed unallocated memory access/double free in in
array_user_key_compare() (MOPB-24 by Stefan Esser) - Fixed a double free inside
session_regenerate_id()(MOPB-22 by Stefan
Esser) - Added missing open_basedir & safe_mode checks to zip:// and bzip://
wrappers. (MOPB-21 by Stefan Esser). - Limit nesting level of input variables with max_input_nesting_level as
fix for (MOPB-03 by Stefan Esser) - Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]
Bug.Center.Team) - Fixed a possible super-global overwrite inside
import_request_variables(). (by Stefano Di Paola, Stefan Esser) - Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc
library. (by Stanislav Malyshev)
Security Enhancements and Fixes in PHP 5.2.2 only:
- Fixed a header injection via Subject and To parameters to the
mail()
function (MOPB-34 by Stefan Esser) - Fixed wrong length calculation in unserialize S type (MOPB-29 by
Stefan Esser) - Fixed substr_compare and substr_count information leak (MOPB-14 by
Stefan Esser) (Stas, Ilia) - Fixed a remotely trigger-able buffer overflow inside
make_http_soap_request(). (by Ilia Alshanetsky) - Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia
Alshanetsky)
Security Enhancements and Fixes in PHP 4.4.7 only:
- XSS in
phpinfo()(MOPB-8 by Stefan Esser)
While majority of the issues outlined above are local, in some
circumstances given specific code paths they can be triggered
externally. Therefor, we strongly recommend that if you use code
utilizing the functions and extensions identified as having had
vulnerabilities in them, you consider upgrading your PHP.
Derick Rethans
PHP 4.4 Release Master
--
Derick Rethans
http://derickrethans.nl | http://ez.no | http://xdebug.org