PHP Release 5.2.11


    PHP 5.2.11 Release Announcement

    The PHP development team would like to announce the immediate availability of PHP 5.2.11. This release focuses on improving the stability of the PHP 5.2.x branch with over 75 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release.

    Security Enhancements and Fixes in PHP 5.2.11:

    • Fixed certificate validation inside php_openssl_apply_verification_policy. (Ryan Sleevi, Ilia)
    • Fixed sanity check for the color index in imagecolortransparent(). (Pierre)
    • Added missing sanity checks around exif processing. (Ilia)
    • Fixed bug #44683 (popen crashes when an invalid mode is passed). (Pierre)

    Key enhancements in PHP 5.2.11 include:

    • Fixed regression in cURL extension that prevented flush of data to output defined as a file handle.
    • A number of fixes for the FILTER_VALIDATE_EMAIL validation rule
    • Fixed bug #49361 (wordwrap() wraps incorrectly on end of line boundaries).
    • Fixed bug #48696 (ldap_read() segfaults with invalid parameters)
    • Fixed bug #48645 (mb_convert_encoding() doesn't understand hexadecimal html-entities).
    • Fixed bug #48619 (imap_search ALL segfaults).
    • Fixed bug #48400 (imap crashes when closing stream opened with OP_PROTOTYPE flag).
    • Fixed bug #47351 (Memory leak in DateTime).
    • Over 60 bug fixes.

    For users upgrading from PHP 5.0 and PHP 5.1, an upgrade guide is available here, detailing the changes between those releases and PHP 5.2.11.

    For a full list of changes in PHP 5.2.11, see the ChangeLog.

    Source Code
    Change Logs
    fixed bug #49286 (php
    • Fixed bug #49289 (bcmath module doesn't compile with phpize configure).
    • Fixed bug #49269 (Ternary operator fails on Iterator object when used inside foreach declaration).
    • Fixed bug #49236 (Missing PHP_SUBST(PDO_MYSQL_SHARED_LIBADD)).
    • Fixed bug #49144 (Import of schema from different host transmits original authentication details).
    • Fixed bug #49132 (posix_times returns false without error).
    • Fixed bug #49125 (Error in dba_exists C code).
    • Fixed bug #49095 (proc_get_status['exitcode'] fails on win32).
    • Fixed bug #49074 (private class static fields can be modified by using reflection).
    • Fixed bug #49072 (feof never returns true for damaged file in zip).
    • Fixed bug #49052 (context option headers freed too early when using --with-curlwrappers).
    fixed bug #49032 (splfileobject
    • Fixed bug #49026 (proc_open() can bypass safe_mode_protected_env_vars restrictions).
    • Fixed bug #49000 (PHP CLI in Interactive mode (php -a) crashes when including files from function).
    • Fixed bug #48994 (zlib.output_compression does not output HTTP headers when set to a string value).
    • Fixed bug #48980 (Crash when compiling with pdo_firebird).
    • Fixed bug #48962 (cURL does not upload files with specified filename).
    • Fixed bug #48929 (Double \r\n after HTTP headers when "header" context option is an array).
    • Fixed bug #48913 (Too long error code strings in pdo_odbc driver).
    • Fixed bug #48802 (printf() returns incorrect outputted length).
    • Fixed bug #48801 (Problem with imagettfbbox).
    • Fixed bug #48788 (RecursiveDirectoryIterator doesn't descend into symlinked directories).
    • Fixed bug #48774 (SIGSEGVs when using curl_copy_handle()).
    • Fixed bug #48763 (ZipArchive produces corrupt archive).
    • Fixed bug #48762 (IPv6 address filter still rejects valid address).
    • Fixed bug #48733 (CURLOPT_WRITEHEADER|CURLOPT_FILE|CURLOPT_STDERR warns on files that have been opened with r+).
    • Fixed bug #48732 (TTF Bounding box wrong for letters below baseline).
    • Fixed bug #48718 (FILTER_VALIDATE_EMAIL does not allow numbers in domain components).
    • Fixed bug #48709 (metaphone and 'wh').
    • Fixed bug #48697 (mb_internal_encoding() value gets reset by parse_str()).
    • Fixed bug #48696 (ldap_read() segfaults with invalid parameters).
    • Fixed bug #48693 (Double declaration of __lambda_func when lambda wrongly formatted).
    • Fixed bug #48661 (phpize is broken with non-bash shells).
    • Fixed bug #48645 (mb_convert_encoding() doesn't understand hexadecimal html-entities).
    • Fixed bug #48637 ("file" fopen wrapper is overwritten when using --with-curlwrappers).
    • Fixed bug #48636 (Error compiling of ext/date on netware).
    • Fixed bug #48629 (get_defined_constants() ignores categorize parameter).
    • Fixed bug #48619 (imap_search ALL segfaults).
    • Fixed bug #48608 (Invalid libreadline version not detected during configure).
    • Fixed bug #48555 (ImageFTBBox() differs from previous versions for texts with new lines)
    • Fixed bug #48539 (pdo_dblib fails to connect, throws empty PDOException "SQLSTATE[] (null)").
    • Fixed bug #48465 (sys_get_temp_dir() possibly inconsistent when using TMPDIR).
    • Fixed bug #48450 (Compile failure under IRIX 6.5.30 building gd.c).
    • Fixed bug #48400 (imap crashes when closing stream opened with OP_PROTOTYPE flag).
    • Fixed bug #48284 (hash "adler32" byte order is reversed).
    • Fixed bug #48276 (date("Y") on big endian machines produces the wrong result).
    • Fixed bug #48247 (Infinite loop and possible crash during startup with errors when errors are logged).
    • Fixed bug #48182 (ssl handshake fails during asynchronous socket connection).
    • Fixed bug #48116 (Fixed build with Openssl 1.0).
    • Fixed bug #48060 (pdo_pgsql - large objects are returned as empty).
    • Fixed bug #48057 (Only the date fields of the first row are fetched, others are empty).
    • Fixed bug #47481 (natcasesort() does not sort extended ASCII characters correctly).
    • Fixed bug #47351 (Memory leak in DateTime).
    • Fixed bug #47273 (Encoding bug in SoapServer->fault).
    • Fixed bug #46020 (with Sun Java System Web Server 7.0 on HPUX, #define HPUX).
    • Fixed bug #45905 (imagefilledrectangle() clipping error).
    • Fixed bug #45280 (Reflection of instantiated COM classes causes PHP to crash).
    • Fixed bug #45141 (setcookie will output expires years of >4 digits).
    • Fixed bug #44683 (popen crashes when an invalid mode is passed).
    • Fixed bug #44144 (spl_autoload_functions() should return object instance when appropriate).
    • Fixed bug #43510 (stream_get_meta_data() does not return same mode as used in fopen).
    • Fixed bug #42434 (ImageLine w/ antialias = 1px shorter).
    • Fixed bug #28038 (Sent incorrect RCPT TO commands to SMTP server)
    • Fixed bug #49572 (use of C++ style comments causes build failure).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top