Skip to content

Commit 1bdfa31

Browse files
krakjoekrakjoe
committed
Merge branch 'master' of https://git.php.net/repository/web/php 
2 parents 8381bf2 + 6aee5c4 commit 1bdfa31

File tree

2 files changed

+58
-49
lines changed

2 files changed

+58
-49
lines changed

‎ChangeLog-5.php

Lines changed: 37 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
?>
88

99
<h1>PHP 5 ChangeLog</h1>
10-
<section class="version" id="5.5.37"><!-- {{{ 5.5.37 -->
11-
<h3>Version 5.5.37</h3>
10+
<section class="version" id="5.6.23"><!-- {{{ 5.6.23 -->
11+
<h3>Version 5.6.23</h3>
1212
<b><?php release_date('23-Jun-2016'); ?></b>
1313
<ul><li>Core:
1414
<ul>
@@ -19,85 +19,88 @@
1919
</ul></li>
2020
<li>GD:
2121
<ul>
22-
<li><?php bugfix(66387); ?> (Stack overflow with imagefilltoborder) (CVE-2015-8874).</li>
22+
<li><?php bugfix(66387); ?> (Stack overflow with imagefilltoborder). (CVE-2015-8874)</li>
2323
<li><?php bugfix(72298); ?> (pass2_no_dither out-of-bounds access).</li>
24-
<li><?php bugfix(72339); ?> (Integer Overflow in _gd2GetHeader() resulting in heap overflow).</li>
24+
<li><?php bugfix(72337); ?> (invalid dimensions can lead to crash).</li>
25+
<li><?php bugfix(72339); ?> (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)</li>
2526
<li><?php bugfix(72407); ?> (NULL Pointer Dereference at _gdScaleVert).</li>
26-
<li><?php bugfix(72446); ?> (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow).</li>
27+
<li><?php bugfix(72446); ?> (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)</li>
28+
</ul></li>
29+
<li>Intl:
30+
<ul>
31+
<li><?php bugfix(70484); ?> (selectordinal doesn't work with named parameters).</li>
2732
</ul></li>
2833
<li>mbstring:
2934
<ul>
30-
<li><?php bugfix(72402); ?> (_php_mb_regex_ereg_replace_exec - double free).</li>
35+
<li><?php bugfix(72402); ?> (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)</li>
3136
</ul></li>
3237
<li>mcrypt:
3338
<ul>
34-
<li><?php bugfix(72455); ?> (Heap Overflow due to integer overflows).</li>
39+
<li><?php bugfix(72455); ?> (Heap Overflow due to integer overflows). (CVE-2016-5769)</li>
40+
</ul></li>
41+
<li>OpenSSL:
42+
<ul>
43+
<li><?php bugfix(72140); ?> (segfault after calling ERR_free_strings()).</li>
44+
</ul></li>
45+
<li>Phar:
46+
<ul>
47+
<li><?php bugfix(72321); ?> (invalid free in phar_extract_file()).</li>
3548
</ul></li>
3649
<li>SPL:
3750
<ul>
38-
<li><?php bugfix(72262); ?> (int/size_t confusion in SplFileObject::fread).</li>
39-
<li><?php bugfix(72433); ?> (Use After Free Vulnerability in PHP's GC algorithm and unserialize).</li>
51+
<li><?php bugfix(72262); ?> (int/size_t confusion in SplFileObject::fread). (CVE-2016-5770)</li>
52+
<li><?php bugfix(72433); ?> (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5771)</li>
4053
</ul></li>
4154
<li>WDDX:
4255
<ul>
43-
<li><?php bugfix(72340); ?> (Double Free Courruption in wddx_deserialize).</li>
56+
<li><?php bugfix(72340); ?> (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)</li>
4457
</ul></li>
4558
<li>zip:
4659
<ul>
47-
<li><?php bugfix(72434); ?> (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize).</li>
60+
<li><?php bugfix(72434); ?> (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)</li>
4861
</ul></li>
4962
</ul>
5063
<!-- }}} --></section>
5164

52-
<section class="version" id="5.6.23"><!-- {{{ 5.6.23 -->
53-
<h3>Version 5.6.23</h3>
65+
<section class="version" id="5.5.37"><!-- {{{ 5.5.37 -->
66+
<h3>Version 5.5.37</h3>
5467
<b><?php release_date('23-Jun-2016'); ?></b>
5568
<ul><li>Core:
5669
<ul>
70+
<li><?php bugfix(72268); ?> (Integer Overflow in nl2br()).</li>
5771
<li><?php bugfix(72275); ?> (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).</li>
5872
<li><?php bugfix(72400); ?> (Integer Overflow in addcslashes/addslashes).</li>
5973
<li><?php bugfix(72403); ?> (Integer Overflow in Length of String-typed ZVAL).</li>
6074
</ul></li>
6175
<li>GD:
6276
<ul>
77+
<li><?php bugfix(66387); ?> (Stack overflow with imagefilltoborder). (CVE-2015-8874)</li>
6378
<li><?php bugfix(72298); ?> (pass2_no_dither out-of-bounds access).</li>
64-
<li><?php bugfix(72337); ?> (invalid dimensions can lead to crash).</li>
65-
<li><?php bugfix(72339); ?> (Integer Overflow in _gd2GetHeader() resulting in heap overflow).</li>
79+
<li><?php bugfix(72339); ?> (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)</li>
6680
<li><?php bugfix(72407); ?> (NULL Pointer Dereference at _gdScaleVert).</li>
67-
<li><?php bugfix(72446); ?> (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow).</li>
68-
</ul></li>
69-
<li>Intl:
70-
<ul>
71-
<li><?php bugfix(70484); ?> (selectordinal doesn't work with named parameters).</li>
81+
<li><?php bugfix(72446); ?> (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)</li>
7282
</ul></li>
7383
<li>mbstring:
7484
<ul>
75-
<li><?php bugfix(72402); ?> (_php_mb_regex_ereg_replace_exec - double free).</li>
85+
<li><?php bugfix(72402); ?> (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)</li>
7686
</ul></li>
77-
<li>mcrypt:
78-
<ul>
79-
<li><?php bugfix(72455); ?> (Heap Overflow due to integer overflows).</li>
8087
</ul></li>
81-
<li>OpenSSL:
82-
<ul>
83-
<li><?php bugfix(72140); ?> (segfault after calling ERR_free_strings()).</li>
84-
</ul></li>
85-
<li>Phar:
88+
<li>mcrypt:
8689
<ul>
87-
<li><?php bugfix(72321); ?> (invalid free in phar_extract_file()).</li>
90+
<li><?php bugfix(72455); ?> (Heap Overflow due to integer overflows). (CVE-2016-5769)</li>
8891
</ul></li>
8992
<li>SPL:
9093
<ul>
91-
<li><?php bugfix(72262); ?> (int/size_t confusion in SplFileObject::fread).</li>
92-
<li><?php bugfix(72433); ?> (Use After Free Vulnerability in PHP's GC algorithm and unserialize).</li>
94+
<li><?php bugfix(72262); ?> (int/size_t confusion in SplFileObject::fread). (CVE-2016-5770)</li>
95+
<li><?php bugfix(72433); ?> (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5771)</li>
9396
</ul></li>
9497
<li>WDDX:
9598
<ul>
96-
<li><?php bugfix(72340); ?> (Double Free Courruption in wddx_deserialize).</li>
99+
<li><?php bugfix(72340); ?> (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)</li>
97100
</ul></li>
98101
<li>zip:
99102
<ul>
100-
<li><?php bugfix(72434); ?> (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize).</li>
103+
<li><?php bugfix(72434); ?> (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)</li>
101104
</ul></li>
102105
</ul>
103106
<!-- }}} --></section>

‎ChangeLog-7.php

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25,22 +25,28 @@
2525
</ul></li>
2626
<li>GD:
2727
<ul>
28+
<li><?php bugfix(66387); ?> (Stack overflow with imagefilltoborder). (CVE-2015-8874)</li>
2829
<li><?php bugfix(72298); ?> (pass2_no_dither out-of-bounds access).</li>
29-
<li><?php bugfix(72337); ?> (invalid dimensions can lead to crash) (Pierre)</li>
30-
<li><?php bugfix(72339); ?> (Integer Overflow in _gd2GetHeader() resulting in heap overflow).</li>
30+
<li><?php bugfix(72337); ?> (invalid dimensions can lead to crash).</li>
31+
<li><?php bugfix(72339); ?> (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)</li>
3132
<li><?php bugfix(72407); ?> (NULL Pointer Dereference at _gdScaleVert).</li>
33+
<li><?php bugfix(72446); ?> (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)</li>
3234
</ul></li>
3335
<li>Intl:
3436
<ul>
35-
<li><?php bugfix(64524); ?> (Add intl.use_exceptions to php.ini-*).</li>
37+
<li><?php bugfix(70484); ?> (selectordinal doesn't work with named parameters).</li>
3638
</ul></li>
3739
<li>mbstring:
3840
<ul>
39-
<li><?php bugfix(72402); ?> (_php_mb_regex_ereg_replace_exec - double free).</li>
41+
<li><?php bugfix(72402); ?> (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)</li>
4042
</ul></li>
4143
<li>mcrypt:
4244
<ul>
43-
<li><?php bugfix(72455); ?> (Heap Overflow due to integer overflows).</li>
45+
<li><?php bugfix(72455); ?> (Heap Overflow due to integer overflows). (CVE-2016-5769)</li>
46+
</ul></li>
47+
<li>OpenSSL:
48+
<ul>
49+
<li><?php bugfix(72140); ?> (segfault after calling ERR_free_strings()).</li>
4450
</ul></li>
4551
<li>PCRE:
4652
<ul>
@@ -51,6 +57,10 @@
5157
<li><?php bugfix(71573); ?> (Segfault (core dumped) if paramno beyond bound).</li>
5258
<li><?php bugfix(72294); ?> (Segmentation fault/invalid pointer in connection with pgsql_stmt_dtor).</li>
5359
</ul></li>
60+
<li>Phar:
61+
<ul>
62+
<li><?php bugfix(72321); ?> (invalid free in phar_extract_file()).</li>
63+
</ul></li>
5464
<li>Phpdbg:
5565
<ul>
5666
<li><?php bugfix(72284); ?> (phpdbg fatal errors with coverage).</li>
@@ -60,18 +70,17 @@
6070
<li><?php bugfix(72195); ?> (pg_pconnect/pg_connect cause use-after-free).</li>
6171
<li><?php bugfix(72197); ?> (pg_lo_create arbitrary read).</li>
6272
</ul></li>
63-
<li>SPL:
64-
<ul>
65-
<li><?php bugfix(72262); ?> (int/size_t confusion in SplFileObject::fread).</li>
66-
<li><?php bugfix(72433); ?> (Use After Free Vulnerability in PHP's GC algorithm and unserialize).</li>
67-
</ul></li>
6873
<li>Standard:
6974
<ul>
7075
<li><?php bugfix(72017); ?> (range() with float step produces unexpected result).</li>
7176
<li><?php bugfix(72193); ?> (dns_get_record returns array containing elements of type 'unknown').</li>
7277
<li><?php bugfix(72229); ?> (Wrong reference when serialize/unserialize an object).</li>
7378
<li><?php bugfix(72300); ?> (ignore_user_abort(false) has no effect).</li>
7479
</ul></li>
80+
<li>WDDX:
81+
<ul>
82+
<li><?php bugfix(72340); ?> (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)</li>
83+
</ul></li>
7584
<li>XML:
7685
<ul>
7786
<li><?php bugfix(72206); ?> (xml_parser_create/xml_parser_free leaks mem).</li>
@@ -80,14 +89,10 @@
8089
<ul>
8190
<li><?php bugfix(72155); ?> (use-after-free caused by get_zval_xmlrpc_type).</li>
8291
</ul></li>
83-
<li>WDDX:
84-
<ul>
85-
<li><?php bugfix(72340); ?> (Double Free Courruption in wddx_deserialize).</li>
86-
</ul></li>
8792
<li>Zip:
8893
<ul>
8994
<li><?php bugfix(72258); ?> (ZipArchive converts filenames to unrecoverable form).</li>
90-
<li><?php bugfix(72434); ?> (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize).</li>
95+
<li><?php bugfix(72434); ?> (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)</li>
9196
</ul></li>
9297
</ul>
9398
<!-- }}} --></section>
@@ -121,6 +126,7 @@
121126
</ul></li>
122127
<li>Intl:
123128
<ul>
129+
<li><?php bugfix(64524); ?> (Add intl.use_exceptions to php.ini-*).</li>
124130
<li><?php bugfix(72241); ?> (get_icu_value_internal out-of-bounds read). (CVE-2016-5093)</li>
125131
</ul></li>
126132
<li>JSON:

0 commit comments

Comments
 (0)