Home » Releases » 5.6 » 5.6.40 »

PHP 5.6.20

PHP 5.6 is no longer officially supported by the PHP project.

Official support refers to that provided direct by the PHP Project.

If you install PHP via third-party packages, support timelines may be different. Please read the Release Support Policy for more information.

The latest release of PHP 5.6 is 5.6.40.

Source Code

Change Log

  • cli server

    • Fixed bug #69953 (Support MKCALENDAR request method).
      Christoph
  • core

    • Fixed bug #71596 (Segmentation fault on ZTS with date function (setlocale)).
      Anatol
  • curl

    • Fixed bug #71694 (Support constant CURLM_ADDED_ALREADY).
      mpyw
  • date

    • Fixed bug #71635 (DatePeriod::getEndDate segfault).
      Thomas Punt
  • fileinfo

    • Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic file). (CVE-2015-8865)
      Anatol
  • mbstring

    • Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in mbfl_strcut). (CVE-2016-4073)
      Stas
  • odbc

    • Fixed bug #47803, #69526 (Executing prepared statements is succesfull only for the first two statements).
      einavitamar at gmail dot com
      Anatol
    • Fixed bug #71860 (Invalid memory write in phar on filename with \0 in name). (CVE-2016-4072)
      Stas
  • pdo_dblib

    • Fixed bug #54648 (PDO::MSSQL forces format of datetime fields).
      steven dot lambeth at gmx dot de
      Anatol
  • phar

    • Fixed bug #71625 (Crash in php7.dll with bad phar filename).
      Anatol
    • Fixed bug #71504 (Parsing of tar file with duplicate filenames causes memory leak).
      Jos Elstgeest
  • snmp

    • Fixed bug #71704 (php_snmp_error() Format String Vulnerability). (CVE-2016-4071)
      andrew at jmpesp dot org
  • standard

    • Fixed bug #71798 (Integer Overflow in php_raw_url_encode). (CVE-2016-4070)
      taoguangchen at icloud dot com
      Stas

PHP 5.6


  Represents a security release