PHP 5.5 Combined Changelog

Explore PHP 5.5

This version is no longer officially supported.

Official support refers to that provided direct by the PHP Project.

If you install PHP via third-party packages, support timelines may be different. Please read the Release Support Policy for more information.

  • PHP 5.5.38

    21 Jul, 2016
    View Release Page
    • bzip2

      • Fixed bug #72613 (Inadequate error handling in bzread()).
        Stas
    • core

      • Fixed bug #70480 (php_url_parse_ex() buffer overflow read).
        Stas
      • Fixed bug #72513 (Stack-based buffer overflow vulnerability in virtual_file_ex).
        loianhtuan at gmail dot com
      • Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session Deserialization).
        taoguangchen at icloud dot com
      • Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications). (CVE-2016-5385)
        Stas
    • exif

      • Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
        Stas
      • Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
        Stas
    • gd

      • Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
        Pierre
      • Fixed bug #72519 (imagegif/output out-of-bounds access).
        Pierre
      • Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()). (CVE-2016-6207)
        Pierre
    • intl

      • Fixed bug #72533 (locale_accept_from_http out-of-bounds access).
        Stas
    • odbc

      • Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)
    • snmp

      • Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).
        taoguangchen at icloud dot com
    • xmlrpc

      • Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).
        Stas
    • zip

      • Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).
        loianhtuan at gmail dot com
  • PHP 5.5.37

    23 Jun, 2016
    View Release Page
    • core

      • Fixed bug #72268 (Integer Overflow in nl2br()).
        Stas
      • Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).
        Stas
      • Fixed bug #72400 (Integer Overflow in addcslashes/addslashes).
        Stas
      • Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL).
        Stas
    • gd

      • Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
        cmb
      • Fixed bug #72298 (pass2_no_dither out-of-bounds access).
        Stas
      • Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)
        Pierre
      • Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert).
        Stas
      • Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)
        Pierre
    • mbstring

      • Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)
        Stas
    • mcrypt

      • Fixed bug #72455 (Heap Overflow due to integer overflows). (CVE-2016-5769)
        Stas
    • spl

      • Fixed bug #72262 (int/size_t confusion in SplFileObject::fread). (CVE-2016-5770)
        Stas
      • Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5771)
        Dmitry
    • wddx

      • Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)
        Stas
    • zip

      • Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)
        Dmitry
  • PHP 5.5.36

    26 May, 2016
    View Release Page
    • core

      • Fixed bug #72114 (Integer underflow / arbitrary null write in fread/gzread). (CVE-2016-5096)
        Stas
      • Fixed bug #72135 (Integer Overflow in php_html_entities). (CVE-2016-5094)
        Stas
    • gd

      • Fixed bug #72227 (imagescale out-of-bounds read). (CVE-2013-7456)
        Stas
    • intl

      • Fixed bug #72241 (get_icu_value_internal out-of-bounds read). (CVE-2016-5093)
        Stas
    • phar

      • Fixed bug #71331 (Uninitialized pointer in phar_make_dirstream()). (CVE-2016-4343)
        Stas
  • PHP 5.5.35

    31 Mar, 2016
    View Release Page
    • bcmath

      • Fixed bug #72093 (bcpowmod accepts negative scale and corrupts _one_ definition).
        Stas
    • exif

      • Fixed bug #72094 (Out of bounds heap read access in exif header processing).
        Stas
    • gd

      • Fixed bug #71912 (libgd: signedness vulnerability). (CVE-2016-3074)
        Stas
    • intl

      • Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos with negative offset).
        Stas
    • xml

      • Fixed bug #72099 (xml_parse_into_struct segmentation fault).
        Stas
  • PHP 5.5.34

    31 Mar, 2016
    View Release Page
    • fileinfo

      • Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic file). (CVE-2015-8865)
        Anatol
    • mbstring

      • Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in mbfl_strcut). (CVE-2016-4073)
        Stas
    • odbc

      • Fixed bug #71860 (Invalid memory write in phar on filename with \0 in name). (CVE-2016-4072)
        Stas
    • snmp

      • Fixed bug #71704 (php_snmp_error() Format String Vulnerability). (CVE-2016-4071)
        andrew at jmpesp dot org
    • standard

      • Fixed bug #71798 (Integer Overflow in php_raw_url_encode). (CVE-2016-4070)
        taoguangchen at icloud dot com
        Stas
  • PHP 5.5.33

    03 Mar, 2016
    View Release Page
    • phar

      • Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()).
        Stas
    • wddx

      • Fixed bug #71587 (Use-After-Free / Double-Free in WDDX Deserialize).
        Stas
  • PHP 5.5.32

    04 Feb, 2016
    View Release Page
    • core

      • Fixed bug #71039 (exec functions ignore length but look for NULL termination).
        Anatol
      • Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input).
        Leo Gaspard
      • Fixed bug #71459 (Integer overflow in iptcembed()).
        Stas
    • gd

      • Improved the fix for bug #70976.
        Remi
    • pcre

      • Upgraded pcrelib to 8.38.
        CVE-2015-8383
        CVE-2015-8386
        CVE-2015-8387
        CVE-2015-8389
        CVE-2015-8390
        CVE-2015-8391
        CVE-2015-8393
        CVE-2015-8394
    • phar

      • Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (CVE-2016-4342)
        Stas
      • Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).
        Stas
      • Fixed bug #71488 (Stack overflow when decompressing tar archives). (CVE-2016-2554)
        Stas
    • wddx

      • Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization).
        Stas
  • PHP 5.5.31

    07 Jan, 2016
    View Release Page
    • fpm

      • Fixed bug #70755 (fpm_log.c memory leak and buffer overflow). (CVE-2016-5114)
        Stas
    • gd

      • Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (CVE-2016-1903) (emmanuel dot law at gmail dot com).
    • wddx

      • Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).
        taoguangchen at icloud dot com
      • Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability).
        taoguangchen at icloud dot com
    • xmlrpc

      • Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()).
        Julien
  • PHP 5.5.30

    01 Oct, 2015
    View Release Page
    • phar

      • Fixed bug #69720 (Null pointer dereference in phar_get_fp_offset()). (CVE-2015-7803)
        Stas
      • Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"). (CVE-2015-7804)
        Stas
  • PHP 5.5.29

    03 Sep, 2015
    View Release Page
    • core

      • Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (CVE-2015-6834)
        Stas
      • Fixed bug #70219 (Use after free vulnerability in session deserializer). (CVE-2015-6835)
        taoguangchen at icloud dot com
    • exif

      • Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).
        Stas
    • hash

      • Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).
        letsgolee at naver dot com
    • pcre

      • Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).
        Anatol Belski
    • soap

      • Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE). (CVE-2015-6836)
        Stas
    • spl

      • Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6834)
        taoguangchen at icloud dot com
      • Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6834)
        taoguangchen at icloud dot com
    • xslt

      • Fixed bug #69782 (NULL pointer dereference).
        CVE-2015-6837
        CVE-2015-6838) (Stas
    • zip

      • Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories). (CVE-2014-9767)
        neal at fb dot com
  • PHP 5.5.28

    06 Aug, 2015
    View Release Page
    • core

      • Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive method calls).
        Stas
      • Fixed bug #69892 (Different arrays compare indentical due to integer key truncation).
        Nikita
      • Fixed bug #70002 (TS issues with temporary dir handling).
        Anatol
      • Fixed bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref).
        Stas
    • openssl

      • Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure). (CVE-2015-8867)
        Stas
    • phar

      • Improved fix for bug #69441.
        Anatol Belski
      • Fixed bug #70019 (Files extracted from archive may be placed outside of destination directory). (CVE-2015-6833)
        Anatol Belski
    • soap

      • Fixed bug #70081 (SoapClient info leak / null pointer dereference via multiple type confusions).
        Stas
    • spl

      • Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items). (CVE-2015-6832)
        sean.heelan
      • Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject). (CVE-2015-6831)
        taoguangchen at icloud dot com
      • Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6831)
        taoguangchen at icloud dot com
      • Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6831)
        taoguangchen at icloud dot com
  • PHP 5.5.27

    09 Jul, 2015
    View Release Page
    • core

      • Fixed bug #69768 (escapeshell*() doesn't cater to !).
        cmb
      • Fixed bug #69703 (Use __builtin_clzl on PowerPC).
        dja at axtens dot net
        Kalle
      • Fixed bug #69732 (can induce segmentation fault with basic php code).
        Dmitry
      • Fixed bug #69642 (Windows 10 reported as Windows 8).
        Christian Wenz
        Anatol Belski
      • Fixed bug #69551 (parse_ini_file() and parse_ini_string() segmentation fault).
        Christoph M. Becker
      • Fixed bug #69781 (phpinfo() reports Professional Editions of Windows 7/8/8.1/10 as "Business").
        Christian Wenz
      • Fixed bug #69835 (phpinfo() does not report many Windows SKUs).
        Christian Wenz
      • Fixed bug #69892 (Different arrays compare indentical due to integer key truncation).
        Nikita
      • Fixed bug #69874 (Can't set empty additional_headers for mail()), regression from fix to bug #68776.
        Yasuo
    • gd

      • Fixed bug #61221 (imagegammacorrect function loses alpha channel).
        cmb
    • mysqlnd

      • Fixed bug #69669 (mysqlnd is vulnerable to BACKRONYM) (CVE-2015-3152).
        Andrey
    • pcre

      • Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the string).
        cmb
      • Fixed bug #69864 (Segfault in preg_replace_callback) (cmb, ab)
    • pdo_pgsql

      • Fixed bug #69752 (PDOStatement::execute() leaks memory with DML Statements when closeCuror() is u).
        Philip Hofstetter
      • Fixed bug #69362 (PDO-pgsql fails to connect if password contains a leading single quote).
        Matteo
      • Fixed bug #69344 (PDO PgSQL Incorrect binding numeric array with gaps).
        Matteo
    • phar

      • Fixed bug #69958 (Segfault in Phar::convertToData on invalid file). (CVE-2015-5589)
        Stas
      • Fixed bug #69923 (Buffer overflow and stack smashing error in phar_fix_filepath). (CVE-2015-5590)
        Stas
    • simplexml

      • Refactored the fix for bug #66084 (simplexml_load_string() mangles empty node name).
        Christoph Michael Becker
    • spl

      • Fixed bug #69737 (Segfault when SplMinHeap::compare produces fatal error).
        Stas
      • Fixed bug #67805 (SplFileObject setMaxLineLength). (Willian Gustavo Veiga).
  • PHP 5.5.26

    11 Jun, 2015
    View Release Page
    • core

      • Fixed bug #69566 (Conditional jump or move depends on uninitialised value in extension trait).
        jbboehr at gmail dot com
      • Fixed bug #66048 (temp. directory is cached during multiple requests).
        Julien
      • Fixed bug #69628 (complex GLOB_BRACE fails on Windows).
        Christoph M. Becker
      • Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4643)
        Max Spelsberg
      • Fixed bug #69646 (OS command injection vulnerability in escapeshellarg). (CVE-2015-4642)
        Anatol Belski
      • Fixed bug #69719 (Incorrect handling of paths with NULs). (CVE-2015-4598)
        Stas
    • gd

      • Fixed bug #69479 (GD fails to build with newer libvpx).
        Remi
    • iconv

      • Fixed bug #48147 (iconv with //IGNORE cuts the string).
        Stas
    • litespeed sapi

      • Fixed bug #68812 (Unchecked return value).
        George Wang
    • mail

      • Fixed bug #68776 (mail() does not have mail header injection prevention for additional headers).
        Yasuo
    • mcrypt

      • Added file descriptor caching to mcrypt_create_iv() (Leigh)
    • pcre

      • Upgraded pcrelib to 8.37.
        CVE-2015-2325
        CVE-2015-2326
    • phar

      • Fixed bug #69680 (phar symlink in binary directory broken).
        Matteo Bernardini
        Remi
    • postgres

      • Fixed bug #69667 (segfault in php_pgsql_meta_data). (CVE-2015-4644)
        Remi
    • opcache

      • Fixed bug #69549 (Memory leak with opcache.optimization_level=0xFFFFFFFF).
        Laruence
        Dmitry
    • sqlite3

      • Upgrade bundled sqlite to 3.8.10.2.
        CVE-2015-3414
        CVE-2015-3415
        CVE-2015-3416) (Kaplan
  • PHP 5.5.25

    14 May, 2015
    View Release Page
    • core

      • Fixed bug #69364 (PHP Multipart/form-data remote dos Vulnerability). (CVE-2015-4024)
        Stas
      • Fixed bug #69403 (str_repeat() sign mismatch based memory corruption).
        Stas
      • Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025)
        Stas
      • Fixed bug #69522 (heap buffer overflow in unpack()).
        Stas
      • Fixed bug #69467 (Wrong checked for the interface by using Trait).
        Laruence
      • Fixed bug #69420 (Invalid read in zend_std_get_method).
        Laruence
      • Fixed bug #60022 ("use statement [...] has no effect" depends on leading backslash).
        Nikita
      • Fixed bug #67314 (Segmentation fault in gc_remove_zval_from_buffer).
        Dmitry
      • Fixed bug #68652 (segmentation fault in destructor).
        Dmitry
      • Fixed bug #69419 (Returning compatible sub generator produces a warning).
        Nikita
      • Fixed bug #69472 (php_sys_readlink ignores misc errors from GetFinalPathNameByHandleA).
        Jan Starke
    • ftp

      • Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4022)
        Stas
    • odbc

      • Fixed bug #69354 (Incorrect use of SQLColAttributes with ODBC 3.0).
        Anatol
      • Fixed bug #69474 (ODBC: Query with same field name from two tables returns incorrect result).
        Anatol
      • Fixed bug #69381 (out of memory with sage odbc driver).
        Frederic Marchall
        Anatol Belski
    • openssl

      • Fixed bug #69402 (Reading empty SSL stream hangs until timeout).
        Daniel Lowrey
    • pcntl

      • Fixed bug #68598 (pcntl_exec() should not allow null char). (CVE-2015-4026)
        Stas
    • phar

      • Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (CVE-2015-4021)
        Stas
  • PHP 5.5.24

    16 Apr, 2015
    View Release Page
    • apache2handler

      • Fixed bug #69218 (potential remote code execution with apache 2.4 apache2handler).
        Gerrit Venema
    • core

      • Fixed bug #66609 (php crashes with __get() and ++ operator in some cases).
        Dmitry
        Laruence
      • Fixed bug #67626 (User exceptions not properly handled in streams).
        Julian
      • Fixed bug #68021 (get_browser() browser_name_regex returns non-utf-8 characters).
        Tjerk
      • Fixed bug #68917 (parse_url fails on some partial urls).
        Wei Dai
      • Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options).
        Anatol Belski
      • Additional fix for bug #69152 (Type confusion vulnerability in exception::getTraceAsString).
        Stas
      • Fixed bug #69212 (Leaking VIA_HANDLER func when exception thrown in __call/... arg passing).
        Nikita
      • Fixed bug #69221 (Segmentation fault when using a generator in combination with an Iterator).
        Nikita
      • Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability).
        Stas
      • Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions).
        Stas
    • curl

      • Implemented FR#69278 (HTTP2 support).
        Masaki Kagaya
      • Fixed bug #68739 (Missing break / control flow).
        Laruence
      • Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER).
        Laruence
    • date

      • Export date_get_immutable_ce so that it can be used by extensions.
        Derick Rethans
      • Fixed bug #69336 (Issues with "last day of <monthname>").
        Derick Rethans
    • enchant

      • Fixed bug #65406 (Enchant broker plugins are in the wrong place in windows builds).
        Anatol
    • ereg

      • Fixed bug #68740 (NULL Pointer Dereference).
        Laruence
    • fileinfo

      • Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault).
        Anatol Belski
    • filter

      • Fixed bug #69202 (FILTER_FLAG_STRIP_BACKTICK ignored unless other flags are used).
        Jeff Welch
      • Fixed bug #69203 (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127).
        Jeff Welch
    • mbstring

      • Fixed bug #68846 (False detection of CJK Unified Ideographs Extension E).
        Masaki Kagaya
    • odbc

      • Fixed bug #69354 (Incorrect use of SQLColAttributes with ODBC 3.0).
        Anatol
    • opcache

      • Fixed bug #69281 (opcache_is_script_cached no longer works).
        danack
      • Fixed bug #68677 (Use After Free). (CVE-2015-1351)
        Laruence
    • openssl

      • Fixed bug #67403 (Add signatureType to openssl_x509_parse).
      • Add a check for RAND_egd to allow compiling against LibreSSL (Leigh)
    • phar

      • Fixed bug #64343 (PharData::extractTo fails for tarball created by BSD tar).
        Mike
      • Fixed bug #64931 (phar_add_file is too restrictive on filename).
        Mike
      • Fixed bug #65467 (Call to undefined method cli_arg_typ_string).
        Mike
      • Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing ".tar").
        Mike
      • Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar).
        Stas
      • Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode).
        Stas
    • postgres

      • Fixed bug #68741 (Null pointer dereference). (CVE-2015-1352)
        Laruence
    • soap

      • Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize() with SoapFault).
        Dmitry
      • Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader (bisected, regression)).
        thomas at shadowweb dot org
        Laruence
    • spl

      • Fixed bug #69227 (Use after free in zval_scan caused by spl_object_storage_get_gc).
        adam dot scarr at 99designs dot com
    • sqlite3

      • Fixed bug #68760 (SQLITE segfaults if custom collator throws an exception).
        Dan Ackroyd
      • Fixed bug #69287 (Upgrade bundled sqlite to 3.8.8.3).
        Anatol
      • Fixed bug #66550 (SQLite prepared statement use-after-free).
        Sean Heelan
  • PHP 5.5.23

    20 Feb, 2015
    View Release Page
    • core

      • Fixed bug #69174 (leaks when unused inner class use traits precedence).
        Laruence
      • Fixed bug #69139 (Crash in gc_zval_possible_root on unserialize).
        Laruence
      • Fixed bug #69121 (Segfault in get_current_user when script owner is not in passwd with ZTS build).
        dan at syneto dot net
      • Fixed bug #65593 (Segfault when calling ob_start from output buffering callback).
        Mike
      • Fixed bug #69017 (Fail to push to the empty array with the constant value defined in class scope).
        Laruence
      • Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file not validated in memory.c).
        nayana at ddproperty dot com
      • Fixed bug #68166 (Exception with invalid character causes segv).
        Rasmus
      • Fixed bug #69141 (Missing arguments in reflection info for some builtin functions).
        kostyantyn dot lysyy at oracle dot com
      • Fixed bug #68976 (Use After Free Vulnerability in unserialize()). (CVE-2015-2787)
        Stas
      • Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options).
        Anatol Belski
      • Fixed bug #69207 (move_uploaded_file allows nulls in path). (CVE-2015-2348)
        Stas
    • cgi

      • Fixed bug #69015 (php-cgi's getopt does not see $argv).
        Laruence
    • cli

      • Fixed bug #67741 (auto_prepend_file messes up __LINE__).
        Reeze Xia
    • curl

      • Fixed bug #69088 (PHP_MINIT_FUNCTION does not fully initialize cURL on Win32).
        Grant Pannell
      • Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported by libcurl.
        Linus Unneback
    • ereg

      • Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (CVE-2015-2305)
        Stas
    • fpm

      • Fixed bug #68822 (request time is reset too early).
        honghu069 at 163 dot com
    • odbc

      • Fixed bug #68964 (Allowed memory size exhausted with odbc_exec).
        Anatol
    • opcache

      • Fixed bug #69125 (Array numeric string as key).
        Laruence
      • Fixed bug #69038 (switch(SOMECONSTANT) misbehaves).
        Laruence
    • openssl

      • Fixed bugs #61285, #68329, #68046, #41631 (encrypted streams don't observe socket timeouts).
        Brad Broerman
    • pgsql

      • Fixed bug #68638 (pg_update() fails to store infinite values).
        william dot welter at 4linux dot com dot br
        Laruence
    • readline

      • Fixed bug #69054 (Null dereference in readline_(read|write)_history() without parameters).
        Laruence
    • soap

      • Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()).
        CVE-2015-4147
        CVE-2015-4148) (andrea dot palazzo at truel dot it
        Laruence
    • spl

      • Fixed bug #69108 ("Segmentation fault" when (de)serializing SplObjectStorage).
        Laruence
      • Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after calling getChildren()).
        Julien
    • zip

      • Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap boundary). (CVE-2015-2331)
        Stas
  • PHP 5.5.22

    20 Feb, 2015
    View Release Page
    • core

      • Removed support for multi-line headers, as the are deprecated by RFC 7230.
        Stas
      • Fixed bug #67068 (getClosure returns somethings that's not a closure).
        Danack at basereality dot com
      • Fixed bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone). (CVE-2015-0273)
        Stas
      • Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow).
        Stas
      • Added NULL byte protection to exec, system and passthru.
        Yasuo
    • date

      • Fixed bug #45081 (strtotime incorrectly interprets SGT time zone).
        Derick
    • dba

      • Fixed bug #68711 (useless comparisons).
        bugreports at internot dot info
    • enchant

      • Fixed bug #68552 (heap buffer overflow in enchant_broker_request_dict()). (CVE-2014-9705)
        Antony
    • fileinfo

      • Fixed bug #68827 (Double free with disabled ZMM).
        Joshua Rogers
    • fpm

      • Fixed bug #66479 (Wrong response to FCGI_GET_VALUES).
        Frank Stolle
      • Fixed bug #68571 (core dump when webserver close the socket).
        redfoxli069 at gmail dot com
        Laruence
    • libxml

      • Fixed bug #64938 (libxml_disable_entity_loader setting is shared between threads).
        Martin Jansen
    • pdo_mysql

      • Fixed bug #68750 (PDOMysql with mysqlnd does not allow the usage of named pipes).
        steffenb198 at aol dot com
    • phar

      • Fixed bug #68901 (use after free). (CVE-2015-2301)
        bugreports at internot dot info
    • pgsql

      • Fixed Bug #65199 'pg_copy_from() modifies input array variable).
        Yasuo
    • sqlite3

      • Fixed bug #68260 (SQLite3Result::fetchArray declares wrong required_num_args).
        Julien
    • mysqli

      • Fixed bug #68114 (linker error on some OS X machines with fixed width decimal support) (Keyur Govande)
      • Fixed bug #68657 (Reading 4 byte floats with Mysqli and libmysqlclient has rounding errors) (Keyur Govande)
    • session

      • Fixed bug #68941 (mod_files.sh is a bash-script) (bugzilla at ii.nl, Yasuo)
      • Fixed Bug #66623 (no EINTR check on flock) (Yasuo)
      • Fixed bug #68063 (Empty session IDs do still start sessions) (Yasuo)
    • standard

      • Fixed bug #65272 (flock() out parameter not set correctly in windows).
        Daniel Lowrey
      • Fixed bug #69033 (Request may get env. variables from previous requests if PHP works as FastCGI).
        Anatol
    • streams

      • Fixed bug which caused call after final close on streams filter.
        Bob
  • PHP 5.5.21

    22 Jan, 2015
    View Release Page
    • core

      • Upgraded crypt_blowfish to version 1.3.
        Leigh
      • Fixed bug #60704 (unlink() bug with some files path).
      • Fixed bug #65419 (Inside trait, self::class != __CLASS__).
        Julien
      • Fixed bug #65576 (Constructor from trait conflicts with inherited constructor).
        dunglas at gmail dot com
      • Fixed bug #55541 (errors spawn MessageBox, which blocks test automation).
        Anatol
      • Fixed bug #68297 (Application Popup provides too few information).
        Anatol
      • Fixed bug #65769 (localeconv() broken in TS builds).
        Anatol
      • Fixed bug #65230 (setting locale randomly broken).
        Anatol
      • Fixed bug #66764 (configure doesn't define EXPANDED_DATADIR / PHP_DATADIR correctly).
        Ferenc
      • Fixed bug #68583 (Crash in timeout thread).
        Anatol
      • Fixed bug #68676 (Explicit Double Free). (CVE-2014-9425)
        Kalle
      • Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize()). (CVE-2015-0231)
        Stefan Esser
    • cgi

      • Fixed bug #68618 (out of bounds read crashes php-cgi). (CVE-2014-9427)
        Stas
    • cli server

      • Fixed bug #68745 (Invalid HTTP requests make web server segfault).
        Adam
    • curl

      • Fixed bug #67643 (curl_multi_getcontent returns '' when CURLOPT_RETURNTRANSFER isn't set).
        Jille Timmermans
    • exif

      • Fixed bug #68799 (Free called on uninitialized pointer). (CVE-2015-0232)
        Stas
    • fileinfo

      • Fixed bug #68671 (incorrect expression in libmagic).
        Joshua Rogers
        Anatol Belski
      • Removed readelf.c and related code from libmagic sources (Remi, Anatol)
      • Fixed bug #68735 (fileinfo out-of-bounds memory access). (CVE-2014-9652)
        Anatol
    • fpm

      • Fixed bug #68751 (listen.allowed_clients is broken).
        Remi
    • gd

      • Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (CVE-2014-9709)
        Jan Bee
        Remi
    • mbstring

      • Fixed bug #68504 (--with-libmbfl configure option not present on Windows).
        Ashesh Vashi
    • mcrypt

      • Fixed possible read after end of buffer and use after free.
        Dmitry
    • opcache

      • Fixed bug #67111 (Memory leak when using "continue 2" inside two foreach loops).
        Nikita
    • openssl

      • Fixed bug #55618 (use case-insensitive cert name matching).
        Daniel Lowrey
    • pcntl

      • Fixed bug #60509 (pcntl_signal doesn't decrease ref-count of old handler when setting SIG_DFL).
        Julien
    • pcre

      • Fixed bug #66679 (Alignment Bug in PCRE 8.34 upstream).
        Rainer Jung
        Anatol Belski
    • pgsql

      • Fixed bug #68697 (lo_export return -1 on failure).
        Ondřej Surý
    • pdo

      • Fixed bug #68371 (PDO#getAttribute() cannot be called with platform-specific attribute names).
        Matteo
    • pdo_mysql

      • Fixed bug #68424 (Add new PDO mysql connection attr to control multi statements option).
        peter dot wolanin at acquia dot com
    • spl

      • Fixed bug #66405 (RecursiveDirectoryIterator::CURRENT_AS_PATHNAME breaks the RecursiveIterator).
        Paul Garvin
      • Fixed bug #65213 (cannot cast SplFileInfo to boolean) (Tjerk)
      • Fixed bug #68479 (Added escape parameter to SplFileObject::fputcsv).
        Salathe
    • sqlite

      • Fixed bug #68120 (Update bundled libsqlite to 3.8.7.2).
        Anatol
    • streams

      • Fixed bug #68532 (convert.base64-encode omits padding bytes).
        blaesius at krumedia dot de
  • PHP 5.5.20

    18 Dec, 2014
    View Release Page
    • core

      • Fixed bug #68091 (Some Zend headers lack appropriate extern "C" blocks).
        Adam
      • Fixed bug #68185 ("Inconsistent insteadof definition."- incorrectly triggered).
        Julien
      • Fixed bug #68370 ("unset($this)" can make the program crash).
        Laruence
      • Fixed bug #68545 (NULL pointer dereference in unserialize.c).
        Anatol
      • Fixed bug #68594 (Use after free vulnerability in unserialize()). (CVE-2014-8142)
        Stefan Esser
    • date

      • Fixed day_of_week function as it could sometimes return negative values internally.
        Derick
    • fpm

      • Fixed bug #68381 (fpm_unix_init_main ignores log_level).
        David Zuelke
        Remi
      • Fixed bug #68420 (listen=9000 listens to ipv6 localhost instead of all addresses).
        Remi
      • Fixed bug #68421 (access.format='%R' doesn't log ipv6 address).
        Remi
      • Fixed bug #68423 (PHP-FPM will no longer load all pools).
        Remi
      • Fixed bug #68428 (listen.allowed_clients is IPv4 only).
        Remi
      • Fixed bug #68452 (php-fpm man page is oudated).
        Remi
      • Fixed request #68458 (Change pm.start_servers default warning to notice).
        David Zuelke
        Remi
      • Fixed bug #68463 (listen.allowed_clients can silently result in no allowed access).
        Remi
      • Fixed request #68391 (php-fpm conf files loading order).
        Florian Margaine
        Remi
      • Fixed bug #68478 (access.log don't use prefix).
        Remi
    • mcrypt

      • Fixed possible read after end of buffer and use after free.
        Dmitry
    • pdo_pgsql

      • Fixed bug #66584 (Segmentation fault on statement deallocation) (Matteo)
      • Fixed bug #67462 (PDO_PGSQL::beginTransaction() wrongly throws exception when not in transaction) (Matteo)
      • Fixed bug #68351 (PDO::PARAM_BOOL and ATTR_EMULATE_PREPARES misbehaving) (Matteo)
    • soap

      • Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes).
        Laruence
    • zlib

      • Fixed bug #53829 (Compiling PHP with large file support will replace function gzopen by gzopen64) (Sascha Kettler, Matteo)
  • PHP 5.5.19

    13 Nov, 2014
    View Release Page
    • core

      • Fixed bug #68095 (AddressSanitizer reports a heap buffer overflow in php_getopt()).
        Stas
      • Fixed bug #68118 ($a->foo .= 'test'; can leave $a->foo undefined).
        Nikita
      • Fixed bug #68129 (parse_url() - incomplete support for empty usernames and passwords) (Tjerk)
      • Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in zend_hash_copy).
        Dmitry
    • curl

      • Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)
    • fileinfo

      • Fixed bug #66242 (libmagic: don't assume char is signed).
        ArdB
      • Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers). (CVE-2014-3710)
        Remi
    • fpm

      • Implemented FR #55508 (listen and listen.allowed_clients should take IPv6 addresses).
        Robin Gloster
    • gd

      • Fixed bug #65171 (imagescale() fails without height param).
        Remi
    • gmp

      • Fixed bug #63595 (GMP memory management conflicts with other libraries using GMP).
        Remi
    • mysqli

      • Fixed bug #68114 (linker error on some OS X machines with fixed width decimal support) (Keyur Govande)
    • odbc

      • Fixed bug #68087 (ODBC not correctly reading DATE column when preceded by a VARCHAR column) (Keyur Govande)
    • spl

      • Fixed bug #68128 (Regression in RecursiveRegexIterator) (Tjerk)
  • PHP 5.5.18

    16 Oct, 2014
    View Release Page
    • core

      • Fixed bug #67985 (Incorrect last used array index copied to new array after unset).
        Tjerk
      • Fixed bug #67739 (Windows 8.1/Server 2012 R2 OS build number reported as 6.2 (instead of 6.3)).
        Christian Wenz
      • Fixed bug #67633 (A foreach on an array returned from a function not doing copy-on-write).
        Nikita
      • Fixed bug #51800 (proc_open on Windows hangs forever).
        Anatol
      • Fixed bug #68044 (Integer overflow in unserialize() (32-bits only)). (CVE-2014-3669)
        Stas
    • curl

      • Fixed bug #68089 (NULL byte injection - cURL lib).
        Stas
    • exif

      • Fixed bug #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
        Stas
    • fpm

      • Fixed bug #65641 (PHP-FPM incorrectly defines the SCRIPT_NAME variable when using Apache, mod_proxy-fcgi and ProxyPass).
        Remi
    • openssl

      • Revert regression introduced by fix of bug #41631
    • reflection

      • Fixed bug #68103 (Duplicate entry in Reflection for class alias).
        Remi
    • session

      • Fixed bug #67972 (SessionHandler Invalid memory read create_sid()).
        Adam
    • xmlrpc

      • Fixed bug #68027 (Global buffer overflow in mkgmtime() function). (CVE-2014-3668)
        Stas
  • PHP 5.5.17

    18 Sep, 2014
    View Release Page
    • core

      • Fixed bug #47358 (glob returns error, should be empty array()).
        Pierre
      • Fixed bug #65463 (SIGSEGV during zend_shutdown()).
        Keyur Govande
      • Fixed bug #66036 (Crash on SIGTERM in apache process).
        Keyur Govande
      • Fixed bug #67878 (program_prefix not honoured in man pages).
        Remi
    • com

      • Fixed bug #41577 (DOTNET is successful once per server run) (Aidas Kasparas)
    • fpm

      • Fixed #67606 (FPM with mod_fastcgi/apache2.4 is broken).
        David Zuelke
    • openssl

      • Fixed bug #41631 (socket timeouts not honored in blocking SSL reads).
        Daniel Lowrey
      • Fixed bug #67850 (extension won't build if openssl compiled without SSLv3) (Daniel Lowrey)
    • spl

      • Fixed bug #67813 (CachingIterator::__construct InvalidArgumentException wrong message).
        tim_siebels_aurich at yahoo dot de
    • date

      • Fixed bug #66091 (memory leaks in DateTime constructor).
        Tjerk
      • Fixed bug #66985 (Some timezones are no longer valid in PHP 5.5.10).
        Derick
      • Fixed bug #67109 (First uppercase letter breaks date string parsing).
        Derick
    • gd

      • Made fontFetch's path parser thread-safe. (Sara).
    • mysqli

      • Fixed bug #67839 (mysqli does not handle 4-byte floats correctly).
        Keyur
    • zlib

      • Fixed bug #67724 (chained zlib filters silently fail with large amounts of data).
        Mike
      • Fixed bug #67865 (internal corruption phar error). Mike
  • PHP 5.5.16

    21 Aug, 2014
    View Release Page
    • com

      • Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
    • fileinfo

      • Fixed bug #67705 (extensive backtracking in rule regular expression). (CVE-2014-3538)
        Remi
      • Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587)
        Remi
    • fpm

      • Fixed bug #67635 (php links to systemd libraries without using pkg-config).
        pacho at gentoo dot org
        Remi
    • gd

      • Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference). (CVE-2014-2497)
        Remi
      • Fixed bug #67730 (Null byte injection possible with imagexxx functions). (CVE-2014-5120)
        Ryan Mauger
    • milter

      • Fixed bug #67715 (php-milter does not build and crashes randomly).
        Mike
    • network

      • Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597)
        Remi
    • openssl

      • Fixed missing type checks in OpenSSL options.
        Yussuf Khalil
        Stas
    • readline

      • Fixed bug #55496 (Interactive mode doesn't force a newline before the prompt).
        Bob
        Johannes
      • Fixed bug #67496 (Save command history when exiting interactive shell with control-c).
        Dmitry Saprykin
        Johannes
    • sessions

      • Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas).
    • core

      • Fixed bug #67693 (incorrect push to the empty array) (Tjerk)
    • odbc

      • Fixed bug #60616 (odbc_fetch_into returns junk data at end of multi-byte char fields).
        Keyur
  • PHP 5.5.15

    24 Jul, 2014
    View Release Page
    • core

      • Fixed bug #67428 (header('Location: foo') will override a 308-399 response code).
        Adam
      • Fixed bug #67436 (Autoloader isn't called if two method definitions don't match).
        Bob
      • Fixed bug #67091 (make install fails to install libphp5.so on FreeBSD 10.0).
        Ferenc
      • Fixed bug #67497 (eval with parse error causes segmentation fault in generator).
        Nikita
      • Fixed bug #67151 (strtr with empty array crashes).
        Nikita
      • Fixed bug #67407 (Windows 8.1/Server 2012 R2 reported as Windows 8/Server 2012).
        Christian Wenz
      • Fixed bug #66608 (Incorrect behavior with nested "finally" blocks).
        Laruence
        Dmitry
      • Implemented FR #34407 (ucwords and Title Case).
        Tjerk
    • cli server

      • Implemented FR #67429 (CLI server is missing some new HTTP response codes).
        Adam
      • Fixed bug #66830 (Empty header causes PHP built-in web server to hang).
        Adam
      • Fixed bug #67594 (Unable to access to apache_request_headers() elements).
        Tjerk
    • fpm

      • Fixed bug #67530 (error_log=syslog ignored).
        Remi
      • Fixed bug #67531 (syslog cannot be set in pool configuration).
        Remi
    • intl

      • Fixed bug #66921 (Wrong argument type hint for function intltz_from_date_time_zone).
        Stas
      • Fixed bug #67052 (NumberFormatter::parse() resets LC_NUMERIC setting).
        Stas
    • opcache

      • Fixed bug #67215 (php-cgi work with opcache, may be segmentation fault happen) (Dmitry, Laruence)
    • pgsql

      • Fixed bug #67550 (Error in code "form" instead of "from", pgsql.c, line 756), which affected builds against libpq < 7.3.
        Adam
    • phar

      • Fixed bug #67587 (Redirection loop on nginx with FPM).
        Christian Weiske
    • spl

      • Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting). (CVE-2014-4698)
        research at insighti dot org
        Laruence
      • Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670)
        Laruence
    • streams

      • Fixed bug #67430 (http:// wrapper doesn't follow 308 redirects).
        Adam
    • session

      • Fixed bug #66827 (Session raises E_NOTICE when session name variable is array).
        Yasuo
  • PHP 5.5.14

    26 Jun, 2014
    View Release Page
    • core

      • Fixed BC break introduced by patch for bug #67072.
        Anatol
        Stas
      • Fixed bug #66622 (Closures do not correctly capture the late bound class (static::) in some cases).
        Levi Morrison
      • Fixed bug #67390 (insecure temporary file use in the configure script).
        Remi) (CVE-2014-3981
      • Fixed bug #67399 (putenv with empty variable may lead to crash).
        Stas
    • cli server

      • Fixed Bug #67406 (built-in web-server segfaults on startup).
        Remi
    • date

      • Fixed bug #67308 (Serialize of DateTime truncates fractions of second).
        Adam
      • Fixed regression in fix for bug #67118 (constructor can't be called twice).
        Remi
    • fileinfo

      • Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary check).
      • Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal string size).
        Francisco Alonso
        Jan Kaluza
        Remi
      • Fixed bug #67411 (fileinfo: cdf_check_stream_offset insufficient boundary check).
        Francisco Alonso
        Jan Kaluza
        Remi
      • Fixed bug #67412 (fileinfo: cdf_count_chain insufficient boundary check).
        Francisco Alonso
        Jan Kaluza
        Remi
      • Fixed bug #67413 (fileinfo: cdf_read_property_info insufficient boundary check).
        Francisco Alonso
        Jan Kaluza
        Remi
    • network

      • Fixed bug #67432 (Fix potential segfault in dns_get_record()).
        CVE-2014-4049). (Sara
    • opcache

      • Fixed issue #183 (TMP_VAR is not only used once).
        Dmitry
        Laruence
    • openssl

      • Fixed bug #65698 (certificates validity parsing does not work past 2050).
        Paul Oehler
      • Fixed bug #66636 (openssl_x509_parse warning with V_ASN1_GENERALIZEDTIME).
        Paul Oehler
    • pdo-odbc

      • Fixed bug #50444 (PDO-ODBC changes for 64-bit).
    • soap

      • Implemented FR #49898 (Add SoapClient::__getCookies()).
        Boro Sitnikovski
    • spl

      • Fixed bug #66127 (Segmentation fault with ArrayObject unset).
        Stas
      • Fixed bug #67359 (Segfault in recursiveDirectoryIterator).
        Laruence
      • Fixed bug #67360 (Missing element after ArrayObject::getIterator).
        Adam
      • Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion). (CVE-2014-3515)
        Stefan Esser
  • PHP 5.5.13

    29 May, 2014
    View Release Page
    • cli server

      • Fixed bug #67079 (Missing MIME types for XML/XSL files).
        Anatol
    • com

      • Fixed bug #66431 (Special Character via COM Interface (CP_UTF8)).
        Anatol
    • core

      • Fixed bug #65701 (copy() doesn't work when destination filename is created by tempnam()).
        Boro Sitnikovski
      • Fixed bug #67072 (Echoing unserialized "SplFileObject" crash).
        Anatol
      • Fixed bug #67245 (usage of memcpy() with overlapping src and dst in zend_exceptions.c).
        Bob
      • Fixed bug #67247 (spl_fixedarray_resize integer overflow).
        Stas
      • Fixed bug #67249 (printf out-of-bounds read).
        Stas
      • Fixed bug #67250 (iptcparse out-of-bounds read).
        Stas
      • Fixed bug #67252 (convert_uudecode out-of-bounds read).
        Stas
    • curl

      • Fixed bug #64247 (CURLOPT_INFILE doesn't allow reset).
        Mike
    • date

      • Fixed bug #67118 (DateTime constructor crash with invalid data).
        Anatol
      • Fixed bug #67251 (date_parse_from_format out-of-bounds read).
        Stas
      • Fixed bug #67253 (timelib_meridian_with_check out-of-bounds read).
        Stas
    • dom

      • Fixed bug #67081 (DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset).
        Anatol
    • fileinfo

      • Fixed bug #66307 (Fileinfo crashes with powerpoint files).
        Anatol
      • Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS) (CVE-2014-0238).
      • Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation) (CVE-2014-0237).
    • fpm

      • Fixed bug #66908 (php-fpm reload leaks epoll_create() file descriptor).
        Julio Pintos
    • gd

      • Fixed bug #67248 (imageaffinematrixget missing check of parameters).
        Stas
    • pcre

      • Fixed bug #67238 (Ungreedy and min/max quantifier bug, applied patch from the upstream).
        Anatol
    • phar

      • Fix bug #64498 ($phar->buildFromDirectory can't compress file with an accent in its name).
        PR #588
  • PHP 5.5.12

    30 Apr, 2014
    View Release Page
    • core

      • Fixed bug #61019 (Out of memory on command stream_get_contents).
        Mike
      • Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace UNIX sockets).
        Mike
      • Fixed bug #66182 (exit in stream filter produces segfault).
        Mike
      • Fixed bug #66736 (fpassthru broken).
        Mike
      • Fixed bug #67024 (getimagesize should recognize BMP files with negative height).
        Gabor Buella
      • Fixed bug #67043 (substr_compare broke by previous change) (Tjerk)
      • Fixed bug #67033 (Remove reference to Windows 95).
        Anatol
    • curl

      • Fixed bug #66562 (curl_exec returns differently than curl_multi_getcontent).
        Freek Lijten
    • date

      • Fixed bug #66721 (__wakeup of DateTime segfaults when invalid object data is supplied).
        Boro Sitnikovski
    • embed

      • Fixed bug #65715 (php5embed.lib isn't provided anymore). (Anatol).
    • fileinfo

      • Fixed bug #66987 (Memory corruption in fileinfo ext / bigendian).
        Remi
    • fpm

      • Fixed bug #66482 (unknown entry 'priority' in php-fpm.conf).
      • Fixed bug #67060 (sapi/fpm: possible privilege escalation due to insecure default configuration) (CVE-2014-0185).
        Stas
    • json

      • Fixed bug #66021 (Blank line inside empty array/object when JSON_PRETTY_PRINT is set).
        Kevin Israel
    • ldap

      • Fixed issue with null bytes in LDAP bindings.
        Matthew Daley
    • mysqli

      • Fixed problem in mysqli_commit()/mysqli_rollback() with second parameter (extra comma) and third parameters (lack of escaping).
        Andrey
    • openssl

      • Fix bug #66942 (memory leak in openssl_seal()).
        Chuan Ma
      • Fix bug #66952 (memory leak in openssl_open()).
        Chuan Ma
    • simplexml

      • Fixed bug #66084 (simplexml_load_string() mangles empty node name) (Anatol)
    • sqlite

      • Fixed bug #66967 (Updated bundled libsqlite to 3.8.4.3).
        Anatol
    • xsl

      • Fixed bug #53965 (<xsl:include> cannot find files with relative paths when loaded with "file://").
        Anatol
    • apache2 handler sapi

      • Fixed Apache log issue caused by APR's lack of support for %zu (APR issue https://issues.apache.org/bugzilla/show_bug.cgi?id=56120).
        Jeff Trawick
  • PHP 5.5.11

    03 Apr, 2014
    View Release Page
    • core

      • Allow zero length comparison in substr_compare() (Tjerk)
      • Fixed bug #60602 (proc_open() changes environment array) (Tjerk)
    • spl

      • Added feature #65545 (SplFileObject::fread()) (Tjerk)
      • Fixed bug #66702 (RegexIterator::INVERT_MATCH does not invert).
        Joshua Thijssen
    • curl

      • Fixed bug #66109 (Can't reset CURLOPT_CUSTOMREQUEST to default behaviour) (Tjerk)
      • Fix compilation on libcurl versions between 7.10.5 and 7.12.2, inclusive.
        Adam
    • fileinfo

      • Fixed bug #66946i (fileinfo: extensive backtracking in awk rule regular expression). (CVE-2013-7345)
        Remi
    • fpm

      • Added clear_env configuration directive to disable clearenv() call.
        Github PR# 598
        Paul Annesley
    • gd

      • Fixed bug #66714 (imageconvolution breakage).
        Brad Daily
      • Fixed bug #66869 (Invalid 2nd argument crashes imageaffinematrixget) (Pierre)
      • Fixed bug #66887 (imagescale - poor quality of scaled image).
        Remi
      • Fixed bug #66890 (imagescale segfault).
        Remi
      • Fixed bug #66893 (imagescale ignore method argument).
        Remi
    • hash

      • hash_pbkdf2() now works correctly if the $length argument is not specified.
        Nikita
    • intl

      • Fixed bug #66873 (A reproductible crash in UConverter when given invalid encoding) (Stas)
    • mail

      • Fixed bug #66535 (Don't add newline after X-PHP-Originating-Script) (Tjerk)
    • mysqli

      • Fixed bug #66762 (Segfault in mysqli_stmt::bind_result() when link closed) (Remi)
    • opcache

      • Added function opcache_is_script_cached().
        Danack
      • Added information about interned strings usage.
        Terry
        Julien
        Dmitry
    • openssl

      • Fixed bug #66833 (Default disgest algo is still MD5, switch to SHA1).
        Remi
    • gmp

      • Fixed bug #66872 (invalid argument crashes gmp_testbit) (Pierre)
    • sqlite

      • Updated bundled libsqlite to 3.8.3.1 (Anatol)
  • PHP 5.5.10

    06 Mar, 2014
    View Release Page
    • core

      • Fixed Request #66574i (Allow multiple paths in php_ini_scanned_path).
        Remi
    • date

      • Fixed bug #45528 (Allow the DateTimeZone constructor to accept timezones per offset too).
        Derick
    • fileinfo

      • Bug #66731 (file: infinite recursion) (CVE-2014-1943).
        Remi
      • Fixed bug #66820 (out-of-bounds memory access in fileinfo) (CVE-2014-2270).
        Remi
    • gd

      • Fixed Bug #66815 (imagecrop(): insufficient fix for NULL defer CVE-2013-7327).
        Tomas Hoger
        Remi
    • json

      • Fixed bug #65753 (JsonSerializeable couldn't implement on module extension) (chobieeee@php.net)
    • ldap

      • Implemented ldap_modify_batch (https://wiki.php.net/rfc/ldap_modify_batch).
        Ondřej Hošek
    • openssl

      • Fixed bug #66501 (Add EC key support to php_openssl_is_private_key).
        Mark Zedwood
    • pcre

      • Upgraded to PCRE 8.34.
        Anatol
    • pgsql

      • Added warning for dangerous client encoding and remove possible injections for pg_insert()/pg_update()/pg_delete()/pg_select().
        Yasuo
  • PHP 5.5.9

    06 Feb, 2014
    View Release Page
    • core

      • Fixed bug #66509 (copy() arginfo has changed starting from 5.4).
        willfitch
    • gd

      • Fixed bug #66356 (Heap Overflow Vulnerability in imagecrop()).
        Laruence
        Remi
    • opcache

      • Fixed bug #66474 (Optimizer bug in constant string to boolean conversion).
        Dmitry
      • Fixed bug #66461 (PHP crashes if opcache.interned_strings_buffer=0).
        Dmitry
      • Fixed bug #66298 (ext/opcache/Optimizer/zend_optimizer.c has dos-style ^M as lineend).
        Laruence
    • pdo_pgsql

      • Fixed bug #62479 (PDO-psql cannot connect if password contains spaces) (willfitch, iliaa)
    • readline

      • Fixed Bug #66412 (readline_clear_history() with libedit causes segfault after #65714).
        Remi
    • session

      • Fixed bug #66469 (Session module is sending multiple set-cookie headers when session.use_strict_mode=1) (Yasuo)
      • Fixed bug #66481 (Segfaults on session_name()).
        cmcdermottroe at engineyard dot com
        Yasuo
    • standard

      • Fixed bug #66395 (basename function doesn't remove drive letter).
        Anatol
    • sockets

      • Fixed bug #66381 (__ss_family was changed on AIX 5.3).
        Felipe
    • zend engine

      • Fixed bug #66009 (Failed compilation of PHP extension with C++ std library using VS 2012).
        Anatol
  • PHP 5.5.8

    09 Jan, 2014
    View Release Page
    • core

      • Disallowed JMP into a finally block.
        Laruence
      • Added validation of class names in the autoload process.
        Dmitry
      • Fixed invalid C code in zend_strtod.c.
        Lior Kaplan
      • Fixed ZEND_MM_MEM_TYPE=mmap_zero.
        Dmitry
        Tony
      • Fixed bug #66041 (list() fails to unpack yielded ArrayAccess object).
        Nikita
      • Fixed bug #65764 (generators/throw_rethrow FAIL with ZEND_COMPILE_EXTENDED_INFO).
        Nikita
      • Fixed bug #61645 (fopen and O_NONBLOCK).
        Mike
      • Fixed bug #66218 (zend_register_functions breaks reflection).
        Remi
    • date

      • Fixed bug #66060 (Heap buffer over-read in DateInterval) (CVE-2013-6712).
        Remi
      • Fixed bug #65768 (DateTimeImmutable::diff does not work).
        Nikita Nefedov
    • dom

      • Fixed bug #65196 (Passing DOMDocumentFragment to DOMDocument::saveHTML() Produces invalid Markup).
        Mike
    • exif

      • Fixed bug #65873 (Integer overflow in exif_read_data()).
        Stas
    • filter

      • Fixed bug #66229 (128.0.0.0/16 isn't reserved any longer).
        Adam
    • gd

      • Fixed bug #64405 (Use freetype-config for determining freetype2 dir(s)).
        Adam
    • pdo_odbc

      • Fixed bug #66311 (Stack smashing protection kills PDO/ODBC queries).
        michael at orlitzky dot com
    • mysqli

      • Fixed bug #65486 (mysqli_poll() is broken on win x64).
        Anatol
    • opcache

      • Fixed revalidate_path=1 behavior to avoid caching of symlinks values.
        Dmitry
      • Fixed Issue #140: "opcache.enable_file_override" doesn't respect "opcache.revalidate_freq". (Dmitry).
    • snmp

      • Fixed SNMP_ERR_TOOBIG handling for bulk walk operations.
        Boris Lytochkin
    • soap

      • Fixed bug #66112 (Use after free condition in SOAP extension).
        martin dot koegler at brz dot gv dot at
    • sockets

      • Fixed bug #65923 (ext/socket assumes AI_V4MAPPED is defined).
        Felipe
    • xsl

      • Fixed bug #49634 (Segfault throwing an exception in a XSL registered function).
        Mike
    • zip

      • Fixed Bug #66321 (ZipArchive::open() ze_obj->filename_len not real).
        Remi
  • PHP 5.5.7

    12 Dec, 2013
    View Release Page
    • cli server

      • Added some MIME types to the CLI web server (Chris Jones)
      • Implemented FR #65917 (getallheaders() is not supported by the built-in web server) - also implements apache_response_headers() (Andrea Faulds)
    • core

      • Fixed bug #66094 (unregister_tick_function tries to cast a Closure to a string).
        Laruence
      • Fixed bug #65969 (Chain assignment with T_LIST failure).
        Dmitry
    • opcache

      • Fixed bug #66176 (Invalid constant substitution).
        Dmitry
      • Fixed bug #65915 (Inconsistent results with require return value).
        Dmitry
      • Fixed bug #65559 (Opcache: cache not cleared if changes occur while running).
        Dmitry
    • readline

      • Fixed Bug #65714 (PHP cli forces the tty to cooked mode).
        Remi
    • openssl

      • Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420). (Stefan Esser).
  • PHP 5.5.6

    14 Nov, 2013
    View Release Page
    • core

      • Fixed bug #65947 (basename is no more working after fgetcsv in certain situation).
        Laruence
      • Improved performance of array_merge() and func_get_args() by eliminating useless copying.
        Dmitry
      • Fixed bug #65939 (Space before ";" breaks php.ini parsing).
        brainstorm at nopcode dot org
      • Fixed bug #65911 (scope resolution operator - strange behavior with $this).
        Bob Weinand
      • Fixed bug #65936 (dangling context pointer causes crash).
        Tony
    • fpm

      • Changed default listen() backlog to 65535.
        Tony
    • json

      • Fixed whitespace part of bug #64874 ("json_decode handles whitespace and case-sensitivity incorrectly").
        Andrea Faulds
    • mysqli

      • Fixed bug #66043 (Segfault calling bind_param() on mysqli).
        Laruence
    • opcache

      • Increased limit for opcache.max_accelerated_files to 1,000,000.
        Chris
      • Fixed issue #115 (path issue when using phar).
        Dmitry
      • Fixed issue #149 (Phar mount points not working with OPcache enabled).
        Dmitry
    • odbc

      • Fixed bug #65950 (Field name truncation if the field name is bigger than 32 characters).
        patch submitted by: michael dot y at zend dot com
        Yasuo
    • pdo

      • Fixed bug #66033 (Segmentation Fault when constructor of PDO statement throws an exception).
        Laruence
      • Fixed bug 65946 (sql_parser permanently converts values bound to strings)
    • standard

      • Fixed bug #64760 (var_export() does not use full precision for floating-point numbers) (Yasuo)
  • PHP 5.5.5

    17 Oct, 2013
    View Release Page
    • core

      • Fixed bug #64979 (Wrong behavior of static variables in closure generators).
        Nikita
      • Fixed bug #65322 (compile time errors won't trigger auto loading).
        Nikita
      • Fixed bug #65821 (By-ref foreach on property access of string offset segfaults).
        Nikita
    • cli server

      • Fixed bug #65633 (built-in server treat some http headers as case-sensitive).
        Adam
      • Fixed bug #65818 (Segfault with built-in webserver and chunked transfer encoding).
        Felipe
      • Added application/pdf to PHP CLI Web Server mime types (Chris Jones)
    • datetime

      • Fixed bug #64157 (DateTime::createFromFormat() reports confusing error message).
        Boro Sitnikovski
      • Fixed bug #65502 (DateTimeImmutable::createFromFormat returns DateTime).
        Boro Sitnikovski
      • Fixed bug #65548 (Comparison for DateTimeImmutable doesn't work).
        Boro Sitnikovski
    • dba extension

      • Fixed bug #65708 (dba functions cast $key param to string in-place, bypassing copy on write).
        Adam
    • filter

      • Add RFC 6598 IPs to reserved addresses.
        Sebastian Nohn
      • Fixed bug #64441 (FILTER_VALIDATE_URL rejects fully qualified domain names).
        Syra
    • ftp

      • Fixed bug #65667 (ftp_nb_continue produces segfault).
        Philip Hofstetter
    • gd

      • Ensure that the defined interpolation method is used with the generic scaling methods.
        Pierre
    • imap

      • Fixed bug #65721 (configure script broken in 5.5.4 and 5.4.20 when enabling imap).
        ryotakatsuki at gmail dot com
    • opcache

      • Added support for GNU Hurd.
        Svante Signell
      • Added function opcache_compile_file() to load PHP scripts into cache without execution.
        Julien
      • Fixed bug #65845 (Error when Zend Opcache Optimizer is fully enabled).
        Dmitry
      • Fixed bug #65665 (Exception not properly caught when opcache enabled).
        Laruence
      • Fixed bug #65510 (5.5.2 crashes in _get_zval_ptr_ptr_var).
        Dmitry
      • Fixed issue #135 (segfault in interned strings if initial memory is too low).
        Julien
    • sockets

      • Fixed bug #65808 (the socket_connect() won't work with IPv6 address).
        Mike
    • spl

      • Fix bug #64782 (SplFileObject constructor make $context optional / give it a default value).
        Nikita
    • standard

      • Fixed bug #61548 (content-type must appear at the end of headers for 201 Location to work in http).
        Mike
    • xmlreader

      • Fixed bug #51936 (Crash with clone XMLReader).
        Mike
      • Fixed bug #64230 (XMLReader does not suppress errors).
        Mike
    • build system

      • Fixed bug #51076 (race condition in shtool's mkdir -p implementation).
        Mike
        Raphael Geissert
      • Fixed bug #62396 ('make test' crashes starting with 5.3.14 (missing gzencode())).
        Mike
  • PHP 5.5.4

    19 Sep, 2013
    View Release Page
    • core

      • Fixed bug #60598 (cli/apache sapi segfault on objects manipulation).
        Laruence
      • Improved fputcsv() to allow specifying escape character.
      • Fixed bug #65490 (Duplicate calls to get lineno & filename for DTRACE_FUNCTION_*).
        Chris Jones
      • Fixed bug #65483 (quoted-printable encode stream filter incorrectly encoding spaces).
        Michael M Slusarz
      • Fixed bug #65481 (shutdown segfault due to serialize) (Mike)
      • Fixed bug #65470 (Segmentation fault in zend_error() with --enable-dtrace).
        Chris Jones
        Kris Van Hees
      • Fixed bug #65225 (PHP_BINARY incorrectly set).
        Patrick Allaert
      • Fixed bug #62692 (PHP fails to build with DTrace).
        Chris Jones
        Kris Van Hees
      • Fixed bug #61759 (class_alias() should accept classes with leading backslashes).
        Julien
      • Fixed bug #46311 (Pointer aliasing issue results in miscompile on gcc4.4).
        Nikita Popov
    • curl

      • Fixed bug #65458 (curl memory leak).
        Adam
    • datetime

      • Fixed bug #65554 (createFromFormat broken when weekday name is followed by some delimiters). (Valentin Logvinskiy, Stas).
      • Fixed bug #65564 (stack-buffer-overflow in DateTimeZone stuff caught by AddressSanitizer). (Remi).
    • opcache

      • Fixed bug #65561 (Zend Opcache on Solaris 11 x86 needs ZEND_MM_ALIGNMENT=4).
        Terry Ellison
    • openssl

      • Fixed bug #64802 (openssl_x509_parse fails to parse subject properly in some cases).
        Mark Jones
    • pdo

      • Fixed bug #64953 (Postgres prepared statement positional parameter casting).
        Mike
    • session

      • Fixed bug #65475 (Session ID is not initialized properly when strict session is enabled).
        Yasuo
      • Fixed bug #51127/#65359 Request #25630/#43980/#54383 (Added php_serialize session serialize handler that uses plain serialize()).
        Yasuo
    • standard

      • Fix issue with return types of password API helper functions. Found via static analysis by cjones.
        Anthony Ferrara
    • zlib

      • Fixed bug #65391 (Unable to send vary header user-agent when ob_start('ob_gzhandler') is called) (Mike)
  • PHP 5.5.3

    22 Aug, 2013
    View Release Page
    • openssl

      • Fixed UMR in fix for CVE-2013-4248.
  • PHP 5.5.2

    15 Aug, 2013
    View Release Page
    • core

      • Fixed bug #65372 (Segfault in gc_zval_possible_root when return reference fails).
        Laruence
      • Fixed value of FILTER_SANITIZE_FULL_SPECIAL_CHARS constant (previously was erroneously set to FILTER_SANITIZE_SPECIAL_CHARS value). (Andrey avp200681 gmail com).
      • Fixed bug #65304 (Use of max int in array_sum).
        Laruence
      • Fixed bug #65291 (get_defined_constants() causes PHP to crash in a very limited case).
        Arpad
      • Fixed bug #62691 (solaris sed has no -i switch).
        Chris Jones
      • Fixed bug #61345 (CGI mode - make install don't work).
        Michael Heimpold
      • Fixed bug #61268 (--enable-dtrace leads make to clobber Zend/zend_dtrace.d) (Chris Jones)
    • dom

      • Added flags option to DOMDocument::schemaValidate() and DOMDocument::schemaValidateSource(). Added LIBXML_SCHEMA_CREATE flag.
        Chris Wright
    • opcache

      • Added opcache.restrict_api configuration directive that may limit usage of OPcache API functions only to particular script(s).
        Dmitry
      • Added support for glob symbols in blacklist entries (?, *, **).
        Terry Elison
        Dmitry
      • Fixed bug #65338 (Enabling both php_opcache and php_wincache AVs on shutdown).
        Dmitry
    • openssl

      • Fixed handling null bytes in subjectAltName (CVE-2013-4248).
        Christian Heimes
    • pdo_mysql

      • Fixed bug #65299 (pdo mysql parsing errors).
        Johannes
    • pgsql

      • Fixed bug #62978 (Disallow possible SQL injections with pg_select()/pg_update() /pg_delete()/pg_insert()).
        Yasuo
      • Fixed bug #65336 (pg_escape_literal/identifier() scilently returns false).
        Yasuo
    • phar

      • Fixed bug #65028 (Phar::buildFromDirectory creates corrupt archives for some specific contents).
        Stas
    • sessions

      • Implemented strict sessions RFC (https://wiki.php.net/rfc/strict_sessions) which protects against session fixation attacks and session collisions.
        CVE-2011-4718). (Yasuo Ohgaki
      • Fixed possible buffer overflow under Windows. Note: Not a security fix.
        Yasuo
      • Changed session.auto_start to PHP_INI_PERDIR.
        Yasuo
    • soap

      • Fixed bug #65018 (SoapHeader problems with SoapServer).
        Dmitry
    • spl

      • Fixed bug #65328 (Segfault when getting SplStack object Value).
        Laruence
      • Added RecursiveTreeIterator setPostfix and getPostifx methods.
        Joshua Thijssen
      • Fixed bug #61697 (spl_autoload_functions returns lambda functions incorrectly).
        Laruence
    • streams

      • Fixed bug #65268 (select() implementation uses outdated tick API).
        Anatol
  • PHP 5.5.1

    18 Jul, 2013
    View Release Page
    • core

      • Fixed bug #65254 (Exception not catchable when exception thrown in autoload with a namespace).
        Laruence
      • Fixed bug #65088 (Generated configure script is malformed on OpenBSD).
        Adam
      • Fixed bug #65108 (is_callable() triggers Fatal Error).
        David Soria Parra
        Laruence
      • Fixed bug #65035 (yield / exit segfault).
        Nikita
      • Fixed bug #65161 (Generator + autoload + syntax error = segfault).
        Nikita
      • hex2bin() raises E_WARNING for invalid hex string.
        Yasuo
      • Fixed bug #65226 (chroot() does not get enabled).
        Anatol
    • opcache

      • Fixed bug #64827 (Segfault in zval_mark_grey (zend_gc.c)).
        Laruence
      • OPcache must be compatible with LiteSpeed SAPI (Dmitry)
    • cgi

      • Fixed Bug #65143 (Missing php-cgi man page).
        Remi
    • cli server

      • Fixed bug #65066 (Cli server not responsive when responding with 422 http status code).
        Adam
    • datetime

      • Fixed fug #65184 (strftime() returns insufficient-length string under multibyte locales).
        Anatol
    • gd

      • Fixed #65070 (bgcolor does not use the same format as the input image with imagerotate).
        Pierre
      • Fixed Bug #65060 (imagecreatefrom... crashes with user streams).
        Remi
      • Fixed Bug #65084 (imagecreatefromjpeg fails with URL).
        Remi
      • Fix gdImageCreateFromWebpCtx and use same logic to load WebP image that other formats.
        Remi
    • intl

      • Add IntlCalendar::setMinimalDaysInFirstWeek()/ intlcal_set_minimal_days_in_first_week().
      • Fixed trailing space in name of constant IntlCalendar::FIELD_FIELD_COUNT.
      • Fixed bug #62759 (Buggy grapheme_substr() on edge case).
        Stas
      • Fixed bug #61860 (Offsets may be wrong for grapheme_stri* functions).
        Stas
    • oci8

      • Bump PECL package info version check to allow PECL installs with PHP 5.5+
    • pdo

      • Allowed PDO_OCI to compile with Oracle Database 12c client libraries.
        Chris Jones
    • pgsql

      • pg_unescape_bytea() raises E_WARNING for invalid inputs.
        Yasuo
    • phar

      • Fixed Bug #65142 (Missing phar man page).
        Remi
    • session

      • Added optional create_sid() argument to session_set_save_handler(), SessionHandler and new SessionIdInterface.
        Leigh
        Arpad
    • sockets

      • Implemented FR #63472 (Setting SO_BINDTODEVICE with socket_set_option).
        Damjan Cvetko
      • Allowed specifying paths in the abstract namespace for the functions socket_bind(), socket_connect() and socket_sendmsg().
        Gustavo
      • Fixed bug #65260 (sendmsg() ancillary data construction for SCM_RIGHTS is faulty).
        Gustavo
    • spl

      • Fixed bug #65136 (RecursiveDirectoryIterator segfault).
        Laruence
      • Fixed bug #61828 (Memleak when calling Directory(Recursive)Iterator /Spl(Temp)FileObject ctor twice).
        Laruence
    • cgi/fastcgi sapi

      • Added PHP_FCGI_BACKLOG, overrides the default listen backlog.
        Arnaud Le Blanc
  • PHP 5.5.0

    20 Jun, 2013
    View Release Page
    • core

      • Added Zend Opcache extension and enable building it by default. More details here: https://wiki.php.net/rfc/optimizerplus.
        Dmitry
      • Added generators and coroutines (https://wiki.php.net/rfc/generators).
        Nikita Popov
      • Added "finally" keyword (https://wiki.php.net/rfc/finally).
        Laruence
      • Added simplified password hashing API (https://wiki.php.net/rfc/password_hash).
        Anthony Ferrara
      • Added support for constant array/string dereferencing.
        Laruence
      • Added array_column function which returns a column in a multidimensional array. https://wiki.php.net/rfc/array_column.
        Ben Ramsey
      • Added boolval().
        Jille Timmermans
      • Added "Z" option to pack/unpack.
        Gustavo
      • Added Generator::throw() method.
        Nikita Popov
      • Added Class Name Resolution As Scalar Via "class" Keyword.
        Ralph Schindler
        Nikita Popov
        Lars
      • Added optional second argument for assert() to specify custom message. Patch by Lonny Kapelushnik (lonny@lonnylot.com).
        Lars
      • Added support for using empty() on the result of function calls and other expressions (https://wiki.php.net/rfc/empty_isset_exprs).
        Nikita Popov
      • Added support for non-scalar Iterator keys in foreach (https://wiki.php.net/rfc/foreach-non-scalar-keys).
        Nikita Popov
      • Added support for list in foreach (https://wiki.php.net/rfc/foreachlist).
        Laruence
      • Added support for changing the process's title in CLI/CLI-Server SAPIs. The implementation is more robust that the proctitle PECL module. More details here: https://wiki.php.net/rfc/cli_process_title.
        Keyur
      • Added ARMv7/v8 versions of various Zend arithmetic functions that are implemented using inline assembler (Ard Biesheuvel)
      • Added systemtap support by enabling systemtap compatible dtrace probes on linux.
        David Soria Parra
      • Optimized access to temporary and compiled VM variables. 8% less memory reads.
        Dmitry
      • The VM stacks for passing function arguments and syntaticaly nested calls were merged into a single stack. The stack size needed for op_array execution is calculated at compile time and preallocated at once. As result all the stack push operatins don't require checks for stack overflow any more.
        Dmitry
      • Improve set_exception_handler while doing reset.
        Laruence
      • Return previous handler when passing NULL to set_error_handler and set_exception_handler.
        Nikita Popov
      • Remove php_logo_guid(), php_egg_logo_guid(), php_real_logo_guid(), zend_logo_guid().
        Adnrew Faulds
      • Drop Windows XP and 2003 support.
        Pierre
      • Implemented FR #64175 (Added HTTP codes as of RFC 6585).
        Jonh Wendell
      • Implemented FR #60738 (Allow 'set_error_handler' to handle NULL).
        Laruence
        Nikita Popov
      • Implemented FR #60524 (specify temp dir by php.ini). (ALeX Kazik).
      • Implemented FR #46487 (Dereferencing process-handles no longer waits on those processes).
        Jille Timmermans
      • Fixed bug #65051 (count() off by one inside unset()).
        Nikita
      • Fixed bug #64988 (Class loading order affects E_STRICT warning).
        Laruence
      • Fixed bug #64966 (segfault in zend_do_fcall_common_helper_SPEC).
        Laruence
      • Fixed bug #64960 (Segfault in gc_zval_possible_root).
        Laruence
      • Fixed bug #64936 (doc comments picked up from previous scanner run).
        Stas
        Jonathan Oddy
      • Fixed bug #64934 (Apache2 TS crash with get_browser()).
        Anatol
      • Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode, CVE 2013-2110).
        Stas
      • Fixed bug #64853 (Use of no longer available ini directives causes crash on TS build).
        Anatol
      • Fixed bug #64821 (Custom Exceptions crash when internal properties overridden).
        Anatol
      • Fixed bug #64720 (SegFault on zend_deactivate).
        Dmitry
      • Fixed bug #64677 (execution operator `` stealing surrounding arguments).
      • Fixed bug #64660 (Segfault on memory exhaustion within function definition).
        Stas
        reported by Juha Kylmänen
      • Fixed bug #64578 (debug_backtrace in set_error_handler corrupts zend heap: segfault).
        Laruence
      • Fixed bug #64565 (copy doesn't report failure on partial copy).
        Remi
      • Fixed bug #64555 (foreach no longer copies keys if they are interned).
        Nikita Popov
      • Fixed bugs #47675 and #64577 (fd leak on Solaris)
      • Fixed bug #64544 (Valgrind warnings after using putenv).
        Laruence
      • Fixed bug #64515 (Memoryleak when using the same variablename 2times in function declaration).
        Laruence
      • Fixed bug #64503 (Compilation fails with error: conflicting types for 'zendparse').
        Laruence
      • Fixed bug #64239 (Debug backtrace changed behavior since 5.4.10 or 5.4.11).
        Dmitry
        Laruence
      • Fixed bug #64523, allow XOR in php.ini.
        Dejan Marjanovic
        Lars
      • Fixed bug #64354 (Unserialize array of objects whose class can't be autoloaded fail).
        Laruence
      • Fixed bug #64370 (microtime(true) less than $_SERVER['REQUEST_TIME_FLOAT']).
        Anatol
      • Fixed bug #64166 (quoted-printable-encode stream filter incorrectly discarding whitespace).
        Michael M Slusarz) (Laruence
      • Fixed bug #64142 (dval to lval different behavior on ppc64).
        Remi
      • Fixed bug #64135 (Exceptions from set_error_handler are not always propagated).
        Laruence
      • Fixed bug #63980 (object members get trimmed by zero bytes).
        Laruence
      • Fixed bug #63874 (Segfault if php_strip_whitespace has heredoc).
        Pierrick
      • Fixed bug #63830 (Segfault on undefined function call in nested generator).
        Nikita Popov
      • Fixed bug #63822 (Crash when using closures with ArrayAccess).
        Nikita Popov
      • Fixed bug #61681 (Malformed grammar).
        Nikita Popov
        Etienne
        Laruence
      • Fixed bug #61038 (unpack("a5", "str\0\0") does not work as expected).
        srgoogleguy
        Gustavo
      • Fixed bug #61025 (__invoke() visibility not honored).
        Laruence
      • Fixed bug #60833 (self, parent, static behave inconsistently case-sensitive).
        Stas
        mario at include-once dot org
      • Fixed Bug #52126: timestamp for mail.log (Martin Jansen, Lars)
      • Fixed bug #49348 (Uninitialized ++$foo->bar; does not cause a notice).
        Stas
      • Fixed Bug #23955: allow specifying Max-Age attribute in setcookie() (narfbg, Lars)
      • Fixed bug #18556 (Engine uses locale rules to handle class names).
        Stas
      • Fix undefined behavior when converting double variables to integers. The double is now always rounded towards zero, the remainder of its division by 2^32 or 2^64 (depending on sizeof(long)) is calculated and it's made signed assuming a two's complement representation.
        Gustavo
      • Drop support for bison < 2.4 when building PHP from GIT source.
        Laruence
    • apache2 handler sapi

      • Enabled Apache 2.4 configure option for Windows (Pierre, Anatoliy)
    • calendar

      • Fixed bug #64895 (Integer overflow in SndToJewish).
        Remi
      • Fixed bug #54254 (cal_from_jd returns month = 6 when there is only one Adar) (Stas, Eitan Mosenkis)
    • cli server

      • Fixed bug #64128 (buit-in web server is broken on ppc64).
        Remi
    • curl

      • Remove curl stream wrappers.
        Pierrick
      • Implemented FR #46439 - added CURLFile for safer file uploads.
        Stas
      • Added support for CURLOPT_FTP_RESPONSE_TIMEOUT, CURLOPT_APPEND, CURLOPT_DIRLISTONLY, CURLOPT_NEW_DIRECTORY_PERMS, CURLOPT_NEW_FILE_PERMS, CURLOPT_NETRC_FILE, CURLOPT_PREQUOTE, CURLOPT_KRBLEVEL, CURLOPT_MAXFILESIZE, CURLOPT_FTP_ACCOUNT, CURLOPT_COOKIELIST, CURLOPT_IGNORE_CONTENT_LENGTH, CURLOPT_CONNECT_ONLY, CURLOPT_LOCALPORT, CURLOPT_LOCALPORTRANGE, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_SSL_SESSIONID_CACHE, CURLOPT_FTP_SSL_CCC, CURLOPT_HTTP_CONTENT_DECODING, CURLOPT_HTTP_TRANSFER_DECODING, CURLOPT_PROXY_TRANSFER_MODE, CURLOPT_ADDRESS_SCOPE, CURLOPT_CRLFILE, CURLOPT_ISSUERCERT, CURLOPT_USERNAME, CURLOPT_PASSWORD, CURLOPT_PROXYUSERNAME, CURLOPT_PROXYPASSWORD, CURLOPT_NOPROXY, CURLOPT_SOCKS5_GSSAPI_NEC, CURLOPT_SOCKS5_GSSAPI_SERVICE, CURLOPT_TFTP_BLKSIZE, CURLOPT_SSH_KNOWNHOSTS, CURLOPT_FTP_USE_PRET, CURLOPT_MAIL_FROM, CURLOPT_MAIL_RCPT, CURLOPT_RTSP_CLIENT_CSEQ, CURLOPT_RTSP_SERVER_CSEQ, CURLOPT_RTSP_SESSION_ID, CURLOPT_RTSP_STREAM_URI, CURLOPT_RTSP_TRANSPORT, CURLOPT_RTSP_REQUEST, CURLOPT_RESOLVE, CURLOPT_A
        Pierrick
      • Added new functions curl_escape, curl_multi_setopt, curl_multi_strerror curl_pause, curl_reset, curl_share_close, curl_share_init, curl_share_setopt curl_strerror and curl_unescape.
        Pierrick
      • Addes new curl options CURLOPT_TELNETOPTIONS, CURLOPT_GSSAPI_DELEGATION, CURLOPT_ACCEPTTIMEOUT_MS, CURLOPT_SSL_OPTIONS, CURLOPT_TCP_KEEPALIVE, CURLOPT_TCP_KEEPIDLE and CURLOPT_TCP_KEEPINTVL.
        Pierrick
      • Fixed bug #55635 (CURLOPT_BINARYTRANSFER no longer used. The constant still exists for backward compatibility but is doing nothing).
        Pierrick
      • Fixed bug #54995 (Missing CURLINFO_RESPONSE_CODE support).
        Pierrick
    • datetime

      • Added DateTimeImmutable - a variant of DateTime that only returns the modified state instead of changing itself.
        Derick
      • Fixed bug #64825 (Invalid free when unserializing DateTimeZone).
        Anatol
      • Fixed bug #64359 (strftime crash with VS2012).
        Anatol
      • Fixed bug #62852 (Unserialize Invalid Date causes crash).
        Anatol
      • Fixed bug #61642 (modify("+5 weekdays") returns Sunday).
        Dmitri Iouchtchenko
      • Fixed bug #60774 (DateInterval::format("%a") is always zero when an interval is created using the createFromDateString method) (Lonny Kapelushnik, Derick)
      • Fixed bug #54567 (DateTimeZone serialize/unserialize) (Lonny Kapelushnik, Derick)
      • Fixed bug #53437 (Crash when using unserialized DatePeriod instance).
        Gustavo
        Derick
        Anatol
    • dba

      • Bug #62489: dba_insert not working as expected.
        marc-bennewitz at arcor dot de
        Lars
    • filter

      • Implemented FR #49180 - added MAC address validation.
        Martin
    • fileinfo

      • Upgraded libmagic to 5.14.
        Anatol
      • Fixed bug #64830 (mimetype detection segfaults on mp3 file).
        Anatol
      • Fixed bug #63590 (Different results in TS and NTS under Windows).
        Anatoliy
      • Fixed bug #63248 (Load multiple magic files from a directory under Windows).
        Anatoliy
    • fpm

      • Add --with-fpm-systemd option to report health to systemd, and systemd_interval option to configure this. The service can now use Type=notify in the systemd unit file.
        Remi
      • Ignore QUERY_STRING when sent in SCRIPT_FILENAME.
        Remi
      • Log a warning when a syscall fails.
        Remi
      • Implemented FR #64764 (add support for FPM init.d script).
        Lior Kaplan
      • Fixed Bug #64915 (error_log ignored when daemonize=0).
        Remi
      • Fixed bug #63999 (php with fpm fails to build on Solaris 10 or 11).
        Adam
      • Fixed some possible memory or resource leaks and possible null dereference detected by code coverity scan.
        Remi
    • gd

      • Fixed Bug #64962 (imagerotate produces corrupted image).
        Remi
      • Fixed Bug #64961 (segfault in imagesetinterpolation).
        Remi
      • Fix build with system libgd >= 2.1 which is now the minimal version required (as build with previous version is broken). No change when bundled libgd is used.
        Ondrej Sury
        Remi
    • hash

      • Added support for PBKDF2 via hash_pbkdf2().
        Anthony Ferrara
      • Fixed Bug #64745 (hash_pbkdf2() truncates data when using default length and hex output).
        Anthony Ferrara
    • intl

      • Added UConverter wrapper.
      • The intl extension now requires ICU 4.0+.
      • Added intl.use_exceptions INI directive, which controls what happens when global errors are set together with intl.error_level.
        Gustavo
      • MessageFormatter::format() and related functions now accepted named arguments and mixed numeric/named arguments in ICU 4.8+.
        Gustavo
      • MessageFormatter::format() and related functions now don't error out when an insufficient argument count is provided. Instead, the placeholders will remain unsubstituted.
        Gustavo
      • MessageFormatter::parse() and MessageFormat::format() (and their static equivalents) don't throw away better than second precision in the arguments.
        Gustavo
      • IntlDateFormatter::__construct and datefmt_create() now accept for the $timezone argument time zone identifiers, IntlTimeZone objects, DateTimeZone objects and NULL.
        Gustavo
      • IntlDateFormatter::__construct and datefmt_create() no longer accept invalid timezone identifiers or empty strings.
        Gustavo
      • The default time zone used in IntlDateFormatter::__construct and datefmt_create() (when the corresponding argument is not passed or NULL is passed) is now the one given by date_default_timezone_get(), not the default ICU time zone.
        Gustavo
      • The time zone passed to the IntlDateFormatter is ignored if it is NULL and if the calendar passed is an IntlCalendar object -- in this case, the IntlCalendar's time zone will be used instead. Otherwise, the time zone specified in the $timezone argument is used instead. This does not affect old code, as IntlCalendar was introduced in this version.
        Gustavo
      • IntlDateFormatter::__construct and datefmt_create() now accept for the $calendar argument also IntlCalendar objects.
        Gustavo
      • IntlDateFormatter::getCalendar() and datefmt_get_calendar() return false if the IntlDateFormatter was set up with an IntlCalendar instead of the constants IntlDateFormatter::GREGORIAN/TRADITIONAL. IntlCalendar did not exist before this version.
        Gustavo
      • IntlDateFormatter::setCalendar() and datefmt_set_calendar() now also accept an IntlCalendar object, in which case its time zone is taken. Passing a constant is still allowed, and still keeps the time zone.
        Gustavo
      • IntlDateFormatter::setTimeZoneID() and datefmt_set_timezone_id() are deprecated. Use IntlDateFormatter::setTimeZone() or datefmt_set_timezone() instead.
        Gustavo
      • IntlDateFormatter::format() and datefmt_format() now also accept an IntlCalendar object for formatting.
        Gustavo
      • Added the classes: IntlCalendar, IntlGregorianCalendar, IntlTimeZone, IntlBreakIterator, IntlRuleBasedBreakIterator and IntlCodePointBreakIterator.
        Gustavo
      • Added the functions: intlcal_get_keyword_values_for_locale(), intlcal_get_now(), intlcal_get_available_locales(), intlcal_get(), intlcal_get_time(), intlcal_set_time(), intlcal_add(), intlcal_set_time_zone(), intlcal_after(), intlcal_before(), intlcal_set(), intlcal_roll(), intlcal_clear(), intlcal_field_difference(), intlcal_get_actual_maximum(), intlcal_get_actual_minimum(), intlcal_get_day_of_week_type(), intlcal_get_first_day_of_week(), intlcal_get_greatest_minimum(), intlcal_get_least_maximum(), intlcal_get_locale(), intlcal_get_maximum(), intlcal_get_minimal_days_in_first_week(), intlcal_get_minimum(), intlcal_get_time_zone(), intlcal_get_type(), intlcal_get_weekend_transition(), intlcal_in_daylight_time(), intlcal_is_equivalent_to(), intlcal_is_lenient(), intlcal_is_set(), intlcal_is_weekend(), intlcal_set_first_day_of_week(), intlcal_set_lenient(), intlcal_equals(), intlcal_get_repeated_wall_time_option(), intlcal_get_skipped_wall_time_option(), intlcal_set_repeated_wall_time_option(), intlcal_set_ski
        Gustavo
      • Added the functions: intltz_create_time_zone(), intltz_create_default(), intltz_get_id(), intltz_get_gmt(), intltz_get_unknown(), intltz_create_enumeration(), intltz_count_equivalent_ids(), intltz_create_time_zone_id_enumeration(), intltz_get_canonical_id(), intltz_get_region(), intltz_get_tz_data_version(), intltz_get_equivalent_id(), intltz_use_daylight_time(), intltz_get_offset(), intltz_get_raw_offset(), intltz_has_same_rules(), intltz_get_display_name(), intltz_get_dst_savings(), intltz_from_date_time_zone(), intltz_to_date_time_zone(), intltz_get_error_code(), intltz_get_error_message().
        Gustavo
      • Added the methods: IntlDateFormatter::formatObject(), IntlDateFormatter::getCalendarObject(), IntlDateFormatter::getTimeZone(), IntlDateFormatter::setTimeZone().
        Gustavo
      • Added the functions: datefmt_format_object(), datefmt_get_calendar_object(), datefmt_get_timezone(), datefmt_set_timezone(), datefmt_get_calendar_object(), intlcal_create_instance().
        Gustavo
    • mbstring

      • Fixed bug #64769 (mbstring PHPTs crash on Windows x64).
        Anatol
    • mcrypt

      • mcrypt_ecb(), mcrypt_cbc(), mcrypt_cfb() and mcrypt_ofb() now throw E_DEPRECATED.
        GoogleGuy
    • mysql

      • This extension is now deprecated, and deprecation warnings will be generated when connections are established to databases via mysql_connect(), mysql_pconnect(), or through implicit connection: use MySQLi or PDO_MySQL instead (https://wiki.php.net/rfc/mysql_deprecation).
        Adam
      • Dropped support for LOAD DATA LOCAL INFILE handlers when using libmysql. Known for stability problems.
        Andrey
      • Added support for SHA256 authentication available with MySQL 5.6.6+.
        Andrey
    • mysqli

      • Added mysqli_begin_transaction()/mysqli::begin_transaction(). Implemented all options, per MySQL 5.6, which can be used with START TRANSACTION, COMMIT and ROLLBACK through options to mysqli_commit()/mysqli_rollback() and their respective OO counterparts. They work in libmysql and mysqlnd mode.
        Andrey
      • Added mysqli_savepoint(), mysqli_release_savepoint().
        Andrey
      • Fixed bug #64726 (Segfault when calling fetch_object on a use_result and DB pointer has closed).
        Laruence
      • Fixed bug #64394 (MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS undeclared when using Connector/C).
        Andrey
    • mysqlnd

      • Add new begin_transaction() call to the connection object. Implemented all options, per MySQL 5.6, which can be used with START TRANSACTION, COMMIT and ROLLBACK.
        Andrey
      • Added mysqlnd_savepoint(), mysqlnd_release_savepoint().
        Andrey
      • Fixed bug #63530 (mysqlnd_stmt::bind_one_parameter crashes, uses wrong alloc for stmt->param_bind).
        Andrey
      • Fixed return value of mysqli_stmt_affected_rows() in the time after prepare() and before execute().
        Andrey
    • pcre

      • Merged PCRE 8.32.
        Anatol
      • Deprecated the /e modifier (https://wiki.php.net/rfc/remove_preg_replace_eval_modifier).
        Nikita Popov
      • Fixed bug #63284 (Upgrade PCRE to 8.31).
        Anatoliy
    • pdo

      • Fixed bug #63176 (Segmentation fault when instantiate 2 persistent PDO to the same db server).
        Laruence
    • pdo_dblib

      • Fixed bug #63638 (Cannot connect to SQL Server 2008 with PDO dblib).
        Stanley Sufficool
      • Fixed bug #64338 (pdo_dblib can't connect to Azure SQL).
        Stanley Sufficool
      • Fixed bug #64808 (FreeTDS PDO getColumnMeta on a prepared but not executed statement crashes).
        Stanley Sufficool
    • pdo_pgsql

      • Fixed Bug #64949 (Buffer overflow in _pdo_pgsql_error).
        Remi
    • pdo_mysql

      • Fixed bug #48724 (getColumnMeta() doesn't return native_type for BIT, TINYINT and YEAR).
        Antony
        Daniel Beardsley
    • pgsql

      • Added pg_escape_literal() and pg_escape_identifier() (Yasuo)
      • Bug #46408: Locale number format settings can cause pg_query_params to break with numerics.
        asmecher
        Lars
    • phar

      • Fixed timestamp update on Phar contents modification.
        Dmitry
    • readline

      • Implement FR #55694 (Expose additional readline variable to prevent default filename completion).
        Hartmel
    • reflection

      • Fixed bug #64007 (There is an ability to create instance of Generator by hand).
        Laruence
    • sockets

      • Added recvmsg() and sendmsg() wrappers. (Gustavo) See https://wiki.php.net/rfc/sendrecvmsg
      • Fixed bug #64508 (Fails to build with --disable-ipv6).
        Gustavo
      • Fixed bug #64287 (sendmsg/recvmsg shutdown handler causes segfault).
        Gustavo
    • spl

      • Fixed bug #64997 (Segfault while using RecursiveIteratorIterator on 64-bits systems).
        Laruence
      • Fixed bug #64264 (SPLFixedArray toArray problem).
        Laruence
      • Fixed bug #64228 (RecursiveDirectoryIterator always assumes SKIP_DOTS).
        patch by kriss@krizalys.com
        Laruence
      • Fixed bug #64106 (Segfault on SplFixedArray[][x] = y when extended).
        Nikita Popov
      • Fix bug #60560 (SplFixedArray un-/serialize, getSize(), count() return 0, keys are strings).
        Adam
      • Fixed bug #52861 (unset fails with ArrayObject and deep arrays).
        Mike Willbanks
      • Implement FR #48358 (Add SplDoublyLinkedList::add() to insert an element at a given offset).
        Mark Baker
        David Soria Parra
    • snmp

      • Fixed bug #64765 (Some IPv6 addresses get interpreted wrong).
        Boris Lytochkin
      • Fixed bug #64159 (Truncated snmpget).
        Boris Lytochkin
      • Fixed bug #64124 (IPv6 malformed).
        Boris Lytochkin
      • Fixed bug #61981 (OO API, walk: $suffix_as_key is not working correctly).
        Boris Lytochkin
    • soap

      • Added SoapClient constructor option 'ssl_method' to specify ssl method.
        Eric Iversen
    • streams

      • Fixed bug #64770 (stream_select() fails with pipes returned by proc_open() on Windows x64).
        Anatol
      • Fixed Windows x64 version of stream_socket_pair() and improved error handling.
        Anatol Belski
    • tokenizer

      • Fixed bug #60097 (token_get_all fails to lex nested heredoc).
        Nikita Popov
    • zip

      • Upgraded libzip to 0.10.1 (Anatoliy)
      • Bug #64452 (Zip crash intermittently).
        Anatol
      • Fixed bug #64342 (ZipArchive::addFile() has to check for file existence).
        Anatol

PHP 5.5


  Represents a security release