Everything
php
Learn Community Releases The PHP Project
Home » Releases » 5.6 » 5.6.40 »

PHP 5.6.23

PHP 5.6 is no longer officially supported by the PHP project.

Official support refers to that provided direct by the PHP Project.

If you install PHP via third-party packages, support timelines may be different. Please read the Release Support Policy for more information.

The latest release of PHP 5.6 is 5.6.40.

Source Code

Change Log

  • core

    • Fixed bug #72268 (Integer Overflow in nl2br()).
      Stas
    • Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).
      Stas
    • Fixed bug #72400 (Integer Overflow in addcslashes/addslashes).
      Stas
    • Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL).
      Stas

  • date

    • Fixed bug #63740 (strtotime seems to use both sunday and monday as start of week).
      Derick

  • gd

    • Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
      cmb
    • Fixed bug #72298 (pass2_no_dither out-of-bounds access).
      Stas
    • Fixed bug #72337 (invalid dimensions can lead to crash).
      Pierre
    • Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)
      Pierre
    • Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert).
      Stas
    • Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)
      Pierre

  • intl

    • Fixed bug #70484 (selectordinal doesn't work with named parameters).
      Anatol

  • mbstring

    • Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)
      Stas

  • mcrypt

    • Fixed bug #72455 (Heap Overflow due to integer overflows). (CVE-2016-5769)
      Stas

  • openssl

    • Fixed bug #72140 (segfault after calling ERR_free_strings()).
      Jakub Zelenka

  • phar

    • Fixed bug #72321 (invalid free in phar_extract_file()).
      hji at dyntopia dot com

  • spl

    • Fixed bug #72262 (int/size_t confusion in SplFileObject::fread). (CVE-2016-5770)
      Stas
    • Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5771)
      Dmitry

  • wddx

    • Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)
      Stas

  • zip

    • Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)
      Dmitry

PHP 5.6


  Represents a security release