Everything

php

PHP 5.4.40

PHP 5.4 is no longer officially supported by the PHP project.

Official support refers to that provided direct by the PHP Project.

If you install PHP via third-party packages, support timelines may be different. Please read the Release Support Policy for more information.

The latest release of PHP 5.4 is 5.4.45.

Source Code

PHP 5.4.40 (tar.bz2)
- sha256: 4898ffe8ac3ccb2d8cc94f7d76a9ea0414d954f5d4479895ddfccdc2e158a51a
PHP 5.4.40 (tar.gz)
- sha256: 663f5d06cd648e81ba4f2d6ad621bb580d83de70240c832dae527c97954da33d

apache2handler
- Fixed bug #69218 (potential remote code execution with apache 2.4 apache2handler). (CVE-2015-3330)
  
  Gerrit Venema
core
- Additional fix for bug #69152 (Type confusion vulnerability in exception::getTraceAsString).
  
  Stas
- Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability).
  
  Stas
- Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions).
  
  Stas
curl
- Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER).
  
  Laruence
ereg
- Fixed bug #68740 (NULL Pointer Dereference).
  
  Laruence
fileinfo
- Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault).
  
  Anatol Belski
gd
- Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (CVE-2014-9709)
  
  Remi
phar
- Fixed bug #68901 (use after free). (CVE-2015-2301)
  
  bugreports at internot dot info
- Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (CVE-2015-2783)
  
  Stas
- Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode). (CVE-2015-3329)
  
  Stas
postgres
- Fixed bug #68741 (Null pointer deference) (CVE-2015-1352).
  
  Xinchen Hui
soap
- Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize() with SoapFault).
  
  Dmitry
sqlite3
- Fixed bug #66550 (SQLite prepared statement use-after-free).
  
  Sean Heelan

Represents a security release