xref: /web-php/releases/4_4_7.php (revision f1cb7e74) 
1<?php
2$_SERVER['BASE_PAGE'] = 'releases/4_4_7.php';
3include_once __DIR__ . '/../include/prepend.inc';
4site_header("PHP 4.4.7 Release Announcement");
5?>
6
7<h1>PHP 4.4.7 Release Announcement</h1>
8<p>
9The PHP development team would like to announce the immediate availability of
10PHP 4.4.7.  This release continues to improve the security and the stability of
11the 4.4 branch and all users are strongly encouraged to upgrade to it as soon
12as possible.
13</p>
14
15<p>
16<b>Security Enhancements and Fixes in PHP 4.4.7:</b>
17</p>
18<ul>
19	<li>Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)</li>
20	<li>Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)</li>
21	<li>Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)</li>
22	<li>Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)</li>
23	<li>Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)</li>
24	<li>Added missing open_basedir &amp; safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser).</li>
25	<li>Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)</li>
26	<li>XSS in phpinfo() (MOPB-8 by Stefan Esser)</li>
27	<li>Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)</li>
28	<li>Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser)</li>
29	<li>Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)</li>
30</ul>
31
32<p>
33While majority of the issues outlined above are local, few issues such as the
34XML-RPC overflows can be triggered remotely and therefor should be considered
35critical. If you use the XML-RPC extension consider upgrading as soon as
36possible.
37</p>
38
39<p>
40<b>Other improvements of PHP 4.4.7 include:</b>
41</p>
42<ul>
43	<li>About 10 bug fixes.</li>
44</ul>
45
46<p>
47 For a full list of changes in PHP 4.4.7, see the <a href="/ChangeLog-4.php#4.4.7">ChangeLog</a>.
48</p>
49
50
51<?php site_footer(); ?>
52