- http://www.securitytracker.com/id/1034608
Jan 7 2016
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): prior to versions 5.5.31, 5.6.17, 7.0.2 …
Solution: The vendor has issued a fix (5.5.31, 5.6.17, 7.0.2)…
PHP 7.0.6, 5.6.21, 5.5.35 released
- https://secure.php.net/
29 Apr 2016
PHP 7.0.6
- https://secure.php.net/archive/2016.php#id2016-04-29-1
29 Apr 2016 - "The PHP development team announces the immediate availability of PHP 7.0.6. This is a security release. Several security bugs were fixed in this release, including:
CVE-2016-3078
CVE-2016-3074
All PHP 7.0 users are encouraged to upgrade to this version. .."
Change log: http://www.php.net/ChangeLog-7.php#7.0.6
- http://www.securitytracker.com/id/1035701
CVE Reference: CVE-2016-3078
Apr 28 2016
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
Version(s): 7.0.5; possibly earlier versions…
Impact: A remote user can create a file that, when loaded by the target application, will execute arbitrary code on the target system.
Solution: The vendor has issued a fix 7.0.6…
PHP 7.0.7, 5.6.22, 5.5.36 released
- https://secure.php.net/
26 May 2016
PHP 7.0.7
- https://secure.php.net/archive/2016.php#id2016-05-26-1
26 May 2016 - "The PHP development team announces the immediate availability of PHP 7.0.7. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version…"
PHP 5.6.22
- https://secure.php.net/archive/2016.php#id2016-05-26-3
26 May 2016 - "The PHP development team announces the immediate availability of PHP 5.6.22. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version…"
PHP 5.5.36
- https://secure.php.net/archive/2016.php#id2016-05-26-2
26 May 2016 - "The PHP development team announces the immediate availability of PHP 5.5.36. This is a security release. Several security bugs were fixed in this release. All PHP 5.5 users are encouraged to upgrade to this version…"
Windows downloads
- http://windows.php.net/download
___
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4343
Last revised: 05/24/2016 - "The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.
CVSS v3 Base Score: 8.8 High
PHP 7.0.8, 5.6.23, 5.5.37 released
- https://secure.php.net/
23 Jun 2016
PHP 7.0.8
- https://secure.php.net/archive/2016.php#id2016-06-23-1
23 Jun 2016 - "The PHP development team announces the immediate availability of PHP 7.0.8. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version…"
PHP 5.6.23
- https://secure.php.net/archive/2016.php#id2016-06-23-2
23 Jun 2016 - "The PHP development team announces the immediate availability of PHP 5.6.23. Several bugs were fixed in this release, including security-related ones. All PHP 5.6 users are encouraged to upgrade to this version…"
PHP 5.5.37
- https://secure.php.net/archive/2016.php#id2016-06-23-3
23 Jun 2016 - "The PHP development team announces the immediate availability of PHP 5.5.37. This is a security release, several security bugs were fixed. All PHP 5.5 users are encouraged to upgrade to this version…"
PHP 7.0.9, 5.6.24, 5.5.38 released
- https://secure.php.net/
21 July 2016
PHP 7.0.9
- https://secure.php.net/archive/2016.php#id2016-07-21-3
"The PHP development team announces the immediate availability of PHP 7.0.9. This is a security release. Several security bugs were fixed in this release, including the HTTP_PROXY issue. All PHP 7.0 users are encouraged to upgrade to this version…"
PHP 5.6.24
- https://secure.php.net/archive/2016.php#id2016-07-21-4
" The PHP development team announces the immediate availability of PHP 5.6.24. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.
- http://www.securitytracker.com/id/1036430
CVE Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5399
Jul 22 2016
Fix Available: Yes Vendor Confirmed: Yes
Impact: A remote or local user can obtain potentially sensitive information on the target system.
A remote or local user can execute arbitrary code on the target system.
The impact depends on the application using PHP on the target system.
Solution: The vendor has issued a fix (5.5.38, 5.6.24, 7.0.9)…
PHP 7.0.10, 5.6.25 released
- https://secure.php.net/
7.0.10 Release Notes
- https://secure.php.net/archive/2016.php#id2016-08-18-1
18 Aug 2016 - "The PHP development team announces the immediate availability of PHP 7.0.10. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version…"
5.6.25 Release Notes
- https://php.net/archive/2016.php#id2016-08-18-2
18 Aug 2016 - "The PHP development team announces the immediate availability of PHP 5.6.25. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version…"
- http://www.securitytracker.com/id/1036680
Aug 20 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): prior to versions 5.6.25, 7.0.10 …
Impact: A remote or local user can cause denial of service conditions.
A remote or local user can execute arbitrary code on the target system.
A remote or local user can obtain potentially sensitive information on the target system.
Solution: The vendor has issued a fix (5.6.25, 7.0.10)…
PHP 7.0.11, 5.6.26 released
- https://secure.php.net/
PHP 7.0.11
- https://secure.php.net/archive/2016.php#id2016-09-15-1
15 Sep 2016 - "The PHP development team announces the immediate availability of PHP 7.0.11. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version…"
PHP 5.6.26
- https://secure.php.net/archive/2016.php#id2016-09-16-1
16 Sep 2016 - "The PHP development team announces the immediate availability of PHP 5.6.26. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version…"
- http://www.securitytracker.com/id/1036836
CVE Reference: CVE-2016-7411, CVE-2016-7412, CVE-2016-7413, CVE-2016-7414, CVE-2016-7416, CVE-2016-7417, CVE-2016-7418
Sep 16 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): prior to versions 5.6.26, 7.0.11 …
Impact: A remote or local user can execute arbitrary code on the target system.
Solution: The vendor has issued a fix (5.6.26, 7.0.11)…
PHP 7.0.12, 5.6.27 released
- https://secure.php.net/
- https://php.net/archive/2016.php#id2016-10-13-1
13 Oct 2016 - "The PHP development team announces the immediate availability of PHP 7.0.12. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version…"
PHP 5.6.27 released
- https://php.net/archive/2016.php#id2016-10-14-1
14 Oct 2016 - "The PHP development team announces the immediate availability of PHP 5.6.27. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version…"
- http://www.securitytracker.com/id/1037033
Oct 18 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 5.6.x prior to 5.6.27, 7.0.x prior to 7.0.12 …
Impact: A remote user can create content that, when loaded by the target application, will execute arbitrary code on the target system.
Solution: The vendor has issued a fix (5.6.27, 7.0.12) …
PHP 7.0.13, 5.6.28 released
- https://secure.php.net/
10 Nov 2016
- https://secure.php.net/archive/2016.php#id2016-11-10-1
"The PHP development team announces the immediate availability of PHP 7.0.13. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version…"
PHP 5.6.28
- https://secure.php.net/archive/2016.php#id2016-11-10-3
"The PHP development team announces the immediate availability of PHP 5.6.28. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version…"
- http://www.securitytracker.com/id/1037272
Nov 11 2016
Impact: Denial of service via local system, Denial of service via network, Execution of arbitrary code via network, User access via local system, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 5.6, 7.0 …
Impact: A user can cause denial of service conditions.
A user can execute arbitrary code on the target system.
Solution: The vendor has issued a fix (5.6.28, 7.0.13)…
PHP 7.1.0 released
- https://secure.php.net/
1 Dec 2016 - "The PHP development team announces the immediate availability of PHP 7.1.0. This release is the first point release in the 7.x series…"
PHP 7.0.14, 5.6.29 released
- https://secure.php.net/
8 Dec 2016 - "The PHP development team announces the immediate availability of PHP 7.0.14. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version…"
PHP 5.6.29
- https://secure.php.net/
8 Dec 2016 - "The PHP development team announces the immediate availability of PHP 5.6.29. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.
PHP 7.1.1, 7.0.15, 5.6.30 released
- https://secure.php.net/
19 Jan 2017 - "The PHP development team announces the immediate availability of PHP 7.1.1. Several bugs have been fixed. All PHP 7.1 users are encouraged to upgrade to this version…"
PHP 7.0.15
- https://secure.php.net/
"The PHP development team announces the immediate availability of PHP 7.0.15. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version…"
PHP 5.6.30
- https://secure.php.net/
"The PHP development team announces the immediate availability of PHP 5.6.30. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version…"
Windows downloads
- http://windows.php.net/download/
___
- http://www.securitytracker.com/id/1037659
Jan 20 2017
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 5.6.x, 7.0.x ..
Impact: A remote or local user can cause denial of service conditions.
A remote or local user can execute arbitrary code on the target system.
A remote or local user can obtain potentially sensitive information on the target system.
Solution: The vendor has issued a fix (5.6.30, 7.0.15)…
