What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Discussion

PHP updates

52 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Post #31
FYI…

PHP 5.4.13, 5.3.23 released
- http://php.net/
14-Mar-2013 - "The PHP development team announces the immediate availability of PHP 5.4.13 and PHP 5.3.23. These releases fix about 15 bugs, including fixes for CVE-2013-1643 and CVE-2013-1635. All users of PHP are encouraged to upgrade to PHP 5.4.13…"

ChangeLog
- http://php.net/ChangeLog-5.php

- http://php.net/downloads.php

- http://windows.php.net/download/

:ph34r:
Post #34 last edited
FYI…

PHP 5.4.16, 5.3.26 released
- http://www.php.net/
06-Jun-2013 - "The PHP development team announces the immediate availability of PHP 5.4.16 and PHP 5.3.26. These releases fix about 15 bugs, including CVE-2013-2110. All users of PHP are encouraged to upgrade to PHP 5.4.16…"

ChangeLog
- http://www.php.net/ChangeLog-5.php

- http://php.net/downloads.php

- http://windows.php.net/download/

- https://secunia.com/advisories/53736/
Release Date: 2013-06-07
Criticality level: Moderately critical
Impact: System access
Where: From remote …
CVE Reference: CVE-2013-2110
Solution: Update to version 5.4.16 or 5.3.26.

:ph34r:
Post #35 last edited
FYI…

PHP 5.4.17 released
- http://php.net/
04-Jul-2013 - "The PHP development team announces the immediate availability of PHP 5.4.17. About -20- bugs were fixed. All users of PHP are encouraged to upgrade to this release…

Changelog - 5.4.17
- http://www.php.net/ChangeLog-5.php#5.4.17

- http://www.php.net/downloads.php

- http://windows.php.net/download/#php-5.4-ts-VC9-x86

:ph34r:
Post #36 last edited
FYI…

PHP 5.3.27 released - PHP 5.3 reaching EOL
- http://php.net/
11-Jul-2013 - "The PHP development team announces the immediate availability of PHP 5.3.27. About 10 bugs were fixed, including a security fix in the XML parser (Bug #65236).
Please Note: This will be the -last- regular release of the PHP 5.3 series. All users of PHP are encouraged to upgrade to PHP 5.4 or PHP 5.5. The PHP 5.3 series will receive only security fixes for the next year…"

ChangeLog
- http://www.php.net/ChangeLog-5.php#5.3.27

Download
- http://windows.php.net/download/#php-5.3-nts-VC9-x86
PHP 5.3 (5.3.27)
___

- https://secunia.com/advisories/54069/
Release Date: 2013-07-12
Criticality level: Moderately Critical
Where: From remote
Impact: System access
… vulnerability is reported in 5.3.x versions prior to 5.3.27.
Solution: Update to version 5.3.27.
Original Advisory: PHP:
- https://bugs.php.net/bug.php?id=65236
- http://www.php.net/ChangeLog-5.php#5.3.27

:ph34r:
Post #38
FYI…

PHP 5.4.18 released
- http://www.php.net/
15-Aug-2013 - "The PHP development team announces the immediate availability of PHP 5.4.18. About 30 bugs were fixed, including security issues CVE-2013-4113 and CVE-2013-4073. All users of PHP are encouraged to upgrade to this release…"

- https://secunia.com/advisories/54554/
Release Date: 2013-08-16
Criticality: Moderately Critical
Impact: Spoofing, System access
Software: PHP 5.4.x
CVE Reference(s): CVE-2013-4073, CVE-2013-4113
For more information:
- https://secunia.com/SA54480/
- https://secunia.com/SA54069/
… vulnerability are reported in versions prior to 5.4.18.
Solution: Update to version 5.4.18.
Original Advisory:
http://php.net/archive/2013.php#id2013-08-15-1
http://www.php.net/ChangeLog-5.php#5.4.18

:ph34r:
Post #39 last edited
FYI…

PHP v5.5.2 released
- http://www.php.net/
16-Aug-2013 - "The PHP development team announces the immediate availability of PHP 5.5.2. About 20 bugs were fixed, including security issue in OpenSSL module (CVE-2013-4248) and session fixation problem (CVE-2011-4718). All users of PHP are encouraged to upgrade to this release…"

- https://secunia.com/advisories/54562/
Release Date: 2013-08-19
Where: From remote
Impact: Hijacking, Spoofing
Solution Status: Vendor Patch
Software: PHP 5.5.x
CVE Reference(s): CVE-2011-4718, CVE-2013-4248
For more information: https://secunia.com/SA54480/
… vulnerabilities are reported in versions prior to 5.5.2.
Solution: Update to version 5.5.2.
Original Advisory:
http://www.php.net/archive/2013.php#id2013-08-16-1
http://www.php.net/ChangeLog-5.php#5.5.2

:ph34r: :ph34r:
Post #40
FYI…

PHP 5.4.19, 5.5.3 released
- http://www.php.net/
22-Aug-2013 - "The PHP development team announces the immediate availability of PHP 5.4.19 and PHP 5.5.3. These releases fix a -bug- in the patch for CVE-2013-4248 in OpenSSL module and compile failure with ZTS enabled in PHP 5.4. All PHP users are encouraged to upgrade to either PHP 5.5.3 or PHP 5.4.19…"

ChangeLog
- http://www.php.net/ChangeLog-5.php

- http://windows.php.net/download/

:ph34r: :ph34r:
Post #41 last edited
FYI…

PHP 5.5.4 released
- http://php.net/
19-Sep-2013 - "The PHP development team announces the immediate availability of PHP 5.5.4. This release fixes several bugs against PHP 5.5.3. All PHP users are encouraged to upgrade to this new version…"

ChangeLog
- http://www.php.net/ChangeLog-5.php
Version 5.5.4 - 19-Sep-2013

- http://windows.php.net/download/
___

PHP 5.4.20 released
- http://www.php.net/
19-Sep-2013 - "The PHP development team announces the immediate availability of PHP 5.4.20. About 30 bugs were fixed. All PHP 5.4 users are encouraged to upgrade to this version…"

:ph34r:
Post #42 last edited

Diagnostic page for php.net
- http://google.com/safebrowsing/diagnostic?site=php.net/
"… The last time Google visited this site was on 2013-11-14, and the last time suspicious content was found on this site was on 2013-10-23…"
___

PHP 5.5.5 released
- http://php.net/
16-Oct-2013 - "The PHP development team announces the immediate availability of PHP 5.5.5. This release fixes about twenty bugs against PHP 5.5.4, some of them regarding the build system. All PHP users are encouraged to upgrade to this new version…"

ChangeLog
- http://www.php.net/ChangeLog-5.php#5.5.5

- http://windows.php.net/download/
___

PHP 5.4.21 Released
- http://php.net/
17-Oct-2013 - "The PHP development team announces the immediate availability of PHP 5.4.21. About 10 bugs were fixed. All PHP 5.4 users are encouraged to upgrade to this version…"

- http://www.php.net/ChangeLog-5.php#5.4.21

- http://windows.php.net/download/#php-5.4-ts-VC9-x86

:ph34r:

Post #43 last edited

FYI…

PHP 5.5.6 released
- http://php.net/archive/2013.php#id2013-11-14-1
14-Nov-2013 - "The PHP development team announces the immediate availability of PHP 5.5.6. This release fixes some bugs against PHP 5.5.5, and adds some performance improvements…"

ChangeLog
- http://www.php.net/ChangeLog-5.php#5.5.6

- http://windows.php.net/download/
___

PHP 5.4.22 Released
- http://php.net/archive/2013.php#id2013-11-14-3
14-Nov-2013 - "The PHP development team announces the immediate availability of PHP 5.4.22. About 10 bugs were fixed. All PHP 5.4 users are encouraged to upgrade to this version…"

- http://www.php.net/ChangeLog-5.php#5.4.22
___

Diagnostic page for php.net
- http://google.com/safebrowsing/diagnostic?site=php.net/
"… The last time Google visited this site was on 2013-11-14, and the last time suspicious content was found on this site was on 2013-10-23…"
 

:ph34r:

Post #44

FYI…

PHP OpenSSL Extension X.509 Certificate Parsing Memory Corruption Vuln
- https://secunia.com/advisories/56055/
Release Date: 2013-12-11
Criticality" Highly Critical
Where: From remote
Impact: System access
Solution Status: Vendor Workaround
Software: PHP 5.3.x, 5.4.x, 5.5.x
CVE Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6420
… vulnerability is reported in versions 5.3.27 and prior, 5.4.22 and prior, and 5.5.6 and prior. Other versions may also be affected.
Solution: Fixed in the source code repository.
Original Advisory:
http://git.php.net/?p=php-src.git;a=commitdiff;h=c1224573c773b6845e83505f717fbf820fc18415
 

:ph34r: :ph34r:

Post #45 last edited

FYI…

PHP 5.5.7 released
- http://php.net/archive/2013.php#id2013-12-12-1
12-Dec-2013 - "The PHP development team announces the immediate availability of PHP 5.5.7. This release fixes some bugs against PHP 5.5.6 and it also includes a fix for CVE-2013-6420 in OpenSSL extension. All users are strongly encouraged to upgrade…."
ChangeLog: http://www.php.net/ChangeLog-5.php#5.5.7
___

PHP 5.4.23 released
- http://www.php.net/archive/2013.php#id2013-12-12-3
12-Dec-2013 - "The PHP development team announces the immediate availability of PHP 5.4.23. About 10 bugs were fixed, including a security issue in OpenSSL module (CVE-2013-6420). All PHP 5.4 users are encouraged to upgrade to this version…"
ChangeLog: http://www.php.net/ChangeLog-5.php#5.4.23
___

PHP 5.3.28 released
- http://php.net/archive/2013.php#id2013-12-12-2
12-Dec-2013 - "The PHP development team announces the immediate availability of PHP 5.3.28. This release fixes two security issues in OpenSSL module in PHP 5.3 - CVE-2013-4073 and CVE-2013-6420. All PHP 5.3 users are encouraged to upgrade to PHP 5.3.28 or latest versions of PHP 5.4 or PHP 5.5…"
ChangeLog: http://www.php.net/ChangeLog-5.php#5.3.28
___

- http://windows.php.net/download/

- https://secunia.com/advisories/56055/
Last Update: 2013-12-16
Criticality: Highly Critical
Impact: System access
Solution Status: Vendor Patch
Software: PHP 5.3.x, 5.4.x, PHP 5.5.x
CVE Reference: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6420 - 7.5 (HIGH)
… vulnerability is reported in versions 5.3.27 and prior, 5.4.22 and prior, and 5.5.6 and prior.
Solution: Update to version 5.3.28, 5.4.23, or 5.5.7.
Original Advisory: PHP: http://php.net/archive/2013.php#id2013-12-12-3

- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4073 - 6.8
 

:ph34r: :ph34r: :ph34r: