1<?php 2$_SERVER['BASE_PAGE'] = 'releases/5_2_2.php'; 3include_once __DIR__ . '/../include/prepend.inc'; 4site_header("PHP 5.2.2 Release Announcement"); 5?> 6 7<h1>PHP 5.2.2 Release Announcement</h1> 8<p> 9The PHP development team would like to announce the immediate availability of PHP 5.2.2. 10This release continues to improve the security and the stability of the 5.X 11branch and all users are strongly encouraged to upgrade to it as soon as possible. 12</p> 13 14<p> 15<b>Security Enhancements and Fixes in PHP 5.2.2:</b> 16</p> 17<ul> 18 <li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)</li> 19 <li>Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser)</li> 20 <li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)</li> 21 <li>Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser)</li> 22 <li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)</li> 23 <li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)</li> 24 <li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)</li> 25 <li>Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-20, MOPB-21 by Stefan Esser).</li> 26 <li>Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)</li> 27 <li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)</li> 28 <li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)</li> 29 <li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Steffan Esser)</li> 30 <li>Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (by Ilia Alshanetsky)</li> 31 <li>Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia Alshanetsky)</li> 32 <li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)</li> 33</ul> 34 35<p> 36While majority of the issues outlined above are local, in some circumstances given specific code paths they can be 37triggered externally. Therefor, we strongly recommend that if you use code utilizing the functions and extensions identified as 38having had vulnerabilities in them, you consider upgrading your PHP. 39</p> 40 41<p> 42<b>The key improvements of PHP 5.2.2 include:</b> 43</p> 44<ul> 45 <li>Further improvements to the Memory Manager with the goal of improving realloc() performance.</li> 46 <li>Bundled GD, SQLite and PCRE libraries were upgraded.</li> 47 <li>Additional methods were added to SPL's DirectoryIterator and SplFileInfo classes.</li> 48 <li>Over 120 bug fixes.</li> 49</ul> 50 51<p> 52For users upgrading from PHP 5.0 and PHP 5.1, an upgrade guide is available 53<a href="/UPDATE_5_2.txt">here</a>, detailing the changes between those releases 54and PHP 5.2.2. 55</p> 56 57<p> 58 For a full list of changes in PHP 5.2.2, see the <a href="/ChangeLog-5.php#5.2.2">ChangeLog</a>. 59</p> 60 61 62<?php site_footer(); ?> 63
