Everything
php
Learn Community Releases The PHP Project
Home » Releases » 5.6 » 5.6.40 »

PHP 5.6.7

PHP 5.6 is no longer officially supported by the PHP project.

Official support refers to that provided direct by the PHP Project.

If you install PHP via third-party packages, support timelines may be different. Please read the Release Support Policy for more information.

The latest release of PHP 5.6 is 5.6.40.

Source Code

  • PHP 5.6.7 (tar.bz2)

    • sha256: 02954fb74c61a7879d48ebdcd4ecb78aa0056f4215ca9b096232de28eb8f17bc

  • PHP 5.6.7 (tar.gz)

    • sha256: 11398540a582c876f5e070207231afde975eb49bb2eeae20b052e8ca325c0f47

  • PHP 5.6.7 (tar.xz)

    • sha256: a85522dd2e6f80ee5637e537447ee54896c77a8fabe49d2310830d0e20952787

Change Log

  • core

    • Fixed bug #69174 (leaks when unused inner class use traits precedence).
      Laruence
    • Fixed bug #69139 (Crash in gc_zval_possible_root on unserialize).
      Laruence
    • Fixed bug #69121 (Segfault in get_current_user when script owner is not in passwd with ZTS build).
      dan at syneto dot net
    • Fixed bug #65593 (Segfault when calling ob_start from output buffering callback).
      Mike
    • Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file not validated in memory.c).
      nayana at ddproperty dot com
    • Fixed bug #68166 (Exception with invalid character causes segv).
      Rasmus
    • Fixed bug #69141 (Missing arguments in reflection info for some builtin functions).
      kostyantyn dot lysyy at oracle dot com
    • Fixed bug #68976 (Use After Free Vulnerability in unserialize()). (CVE-2015-2787)
      Stas
    • Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options).
      Anatol Belski
    • Fixed bug #69207 (move_uploaded_file allows nulls in path). (CVE-2015-2348)
      Stas

  • cgi

    • Fixed bug #69015 (php-cgi's getopt does not see $argv).
      Laruence

  • cli

    • Fixed bug #67741 (auto_prepend_file messes up __LINE__).
      Reeze Xia

  • curl

    • Fixed bug #69088 (PHP_MINIT_FUNCTION does not fully initialize cURL on Win32).
      Grant Pannell
    • Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported by libcurl.
      Linus Unneback

  • ereg

    • Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (CVE-2015-2305)
      Stas

  • fpm

    • Fixed bug #68822 (request time is reset too early).
      honghu069 at 163 dot com

  • odbc

    • Fixed bug #68964 (Allowed memory size exhausted with odbc_exec).
      Anatol

  • opcache

    • Fixed bug #69159 (Opcache causes problem when passing a variable variable to a function).
      Dmitry
      Laruence
    • Fixed bug #69125 (Array numeric string as key).
      Laruence
    • Fixed bug #69038 (switch(SOMECONSTANT) misbehaves).
      Laruence

  • openssl

    • Fixed bug #68912 (Segmentation fault at openssl_spki_new).
      Laruence
    • Fixed bug #61285, #68329, #68046, #41631 (encrypted streams don't observe socket timeouts).
      Brad Broerman
    • Fixed bug #68920 (use strict peer_fingerprint input checks) (Daniel Lowrey)
    • Fixed bug #68879 (IP Address fields in subjectAltNames not used) (Daniel Lowrey)
    • Fixed bug #68265 (SAN match fails with trailing DNS dot) (Daniel Lowrey)
    • Fixed bug #67403 (Add signatureType to openssl_x509_parse) (Daniel Lowrey)
    • Fixed bug (#69195 Inconsistent stream crypto values across versions) (Daniel Lowrey)

  • pgsql

    • Fixed bug #68638 (pg_update() fails to store infinite values).
      william dot welter at 4linux dot com dot br
      Laruence

  • readline

    • Fixed bug #69054 (Null dereference in readline_(read|write)_history() without parameters).
      Laruence

  • soap

    • Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()).
      CVE-2015-4147
      CVE-2015-4148) (andrea dot palazzo at truel dot it
      Laruence

  • spl

    • Fixed bug #69108 ("Segmentation fault" when (de)serializing SplObjectStorage).
      Laruence
    • Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after calling getChildren()).
      Julien

  • zip

    • Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap boundary). (CVE-2015-2331)
      Stas

PHP 5.6


  Represents a security release