PHP Release 5.2.14


    PHP 5.2.14 Release Announcement

    The PHP development team would like to announce the immediate availability of PHP 5.2.14. This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related.

    This release marks the end of the active support for PHP 5.2. Following this release the PHP 5.2 series will receive no further active bug maintenance. Security fixes for PHP 5.2 might be published on a case by cases basis. All users of PHP 5.2 are encouraged to upgrade to PHP 5.3.

    Security Enhancements and Fixes in PHP 5.2.14:

    • Rewrote var_export() to use smart_str rather than output buffering, prevents data disclosure if a fatal error occurs.
    • Fixed a possible interruption array leak in strrchr().(CVE-2010-2484)
    • Fixed a possible interruption array leak in strchr(), strstr(), substr(), chunk_split(), strtok(), addcslashes(), str_repeat(), trim().
    • Fixed a possible memory corruption in substr_replace().
    • Fixed SplObjectStorage unserialization problems (CVE-2010-2225).
    • Fixed a possible stack exaustion inside fnmatch().
    • Fixed a NULL pointer dereference when processing invalid XML-RPC requests (Fixes CVE-2010-0397, bug #51288).
    • Fixed handling of session variable serialization on certain prefix characters.
    • Fixed a possible arbitrary memory access inside sqlite extension. Reported by Mateusz Kocielski.

    Key enhancements in PHP 5.2.14 include:

    • Upgraded bundled PCRE to version 8.02.
    • Updated timezone database to version 2010.5.
    • Fixed bug #52238 (Crash when an Exception occured in iterator_to_array).
    • Fixed bug #52237 (Crash when passing the reference of the property of a non-object).
    • Fixed bug #52041 (Memory leak when writing on uninitialized variable returned from function).
    • Fixed bug #51822 (Segfault with strange __destruct() for static class variables).
    • Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues).
    • Fixed bug #49267 (Linking fails for iconv on MacOS: "Undefined symbols: _libiconv").

    To prepare for upgrading to PHP 5.3, now that PHP 5.2's support ended, a migration guide available on http://php.net/migration53, details the changes between PHP 5.2 and PHP 5.3.

    For a full list of changes in PHP 5.2.14 see the ChangeLog at .

    Source Code
    Change Logs
    reset error state in pdo
    • Fixed a possible stack exaustion inside fnmatch(). Reporeted by Stefan Esser
    • Fixed a NULL pointer dereference when processing invalid XML-RPC requests (Fixes CVE-2010-0397, bug #51288).
    • Fixed handling of session variable serialization on certain prefix characters. Reported by Stefan Esser
    • Fixed a possible arbitrary memory access inside sqlite extension. Reported by Mateusz Kocielski.
    • Fixed a crash when calling an inexistent method of a class that inherits PDOStatement if instantiated directly instead of doing by the PDO methods.
    • Fixed bug #52944 (Invalid write on second and subsequent reads with an inflate filter fed invalid data).
    • Fixed bug #52317 (Segmentation fault when using mail() on a rhel 4.x (only 64 bit)).
    • Fixed bug #52238 (Crash when an Exception occured in iterator_to_array).
    • Fixed bug #52237 (Crash when passing the reference of the property of a non-object).
    fixed bug #52163 (splfileobject
    • Fixed bug #52162 (custom request header variables with numbers are removed).
    • Fixed bug #52160 (Invalid E_STRICT redefined constructor error).
    • Fixed bug #52061 (memory_limit above 2G).
    • Fixed bug #52041 (Memory leak when writing on uninitialized variable returned from function).
    • Fixed bug #52037 (Concurrent builds fail in install-programs).
    • Fixed bug #52019 (make lcov doesn't support TESTS variable anymore).
    • Fixed bug #52010 (open_basedir restrictions mismatch on vacuum command).
    fixed bug #51911 (reflectionparameter
    • Fixed bug #51905 (ReflectionParameter fails if default value is an array with an access to self::).
    • Fixed bug #51822 (Segfault with strange __destruct() for static class variables).
    • Fixed bug #51671 (imagefill does not work correctly for small images).
    • Fixed bug #51670 (getColumnMeta causes segfault when re-executing query after calling nextRowset).
    • Fixed bug #51629 (CURLOPT_FOLLOWLOCATION error message is misleading).
    • Fixed bug #51617 (PDO PGSQL still broken against PostGreSQL < 7.4).
    • Fixed bug #51615 (PHP crash with wrong HTML in SimpleXML).
    fixed bug #51608 (pg_copy_to
    • Fixed bug #51607 (pg_copy_from does not allow schema in the tablename argument).
    • Fixed bug #51604 (newline in end of header is shown in start of message).
    • Fixed bug #51562 (query timeout in mssql can not be changed per query).
    • Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues).
    fixed bug #51532 (wrong prototype for splfileobject
    • Fixed bug #51445 (var_dump() invalid/slow *RECURSION* detection).
    fixed bug #51393 (datetime
    • Fixed bug #51374 (Wrongly initialized object properties).
    • Fixed bug #51338 (URL-Rewriter is still enabled if use_only_cookies is on).
    • Fixed bug #51273 (Faultstring property does not exist when the faultstring is empty)
    • Fixed bug #51269 (zlib.output_compression Overwrites Vary Header).
    • Fixed bug #51263 (imagettftext and rotated text uses wrong baseline)
    • Fixed bug #51237 (milter SAPI crash on startup).
    • Fixed bug #51213 (pdo_mssql is trimming value of the money column).
    • Fixed bug #51192 (FILTER_VALIDATE_URL will invalidate a hostname that includes '-'). .
    • Fixed bug #51190 (ftp_put() returns false when transfer was successful).
    • Fixed bug #51183 (ext/date/php_date.c fails to compile with Sun Studio).
    • Fixed bug #51171 (curl_setopt() doesn't output any errors or warnings when an invalid option is provided).
    • Fixed bug #51128 (imagefill() doesn't work with large images).
    • Fixed bug #51086 (DBA DB4 doesn't work with Berkeley DB 4.8).
    • Fixed bug #51062 (DBA DB4 uses mismatched headers and libraries).
    • Fixed bug #51023 (filter doesn't detect int overflows with GCC 4.4).
    • Fixed bug #50762 (in WSDL mode Soap Header handler function only being called if defined in WSDL).
    • Fixed bug #50698 (SoapClient should handle wsdls with some incompatiable endpoints).
    • Fixed bug #50383 (Exceptions thrown in __call() / __callStatic() do not include file and line in trace).
    • Fixed bug #49730 (Firebird - new PDO() returns NULL).
    • Fixed bug #49723 (LimitIterator with empty SeekableIterator).
    • Fixed bug #49687 (utf8_decode vulnerabilities and deficiencies in the number of reported malformed sequences). (CVE-2010-3870)
    • Fixed bug #49576 (FILTER_VALIDATE_EMAIL filter needs updating)
    • Fixed bug #49320 (PDO returns null when SQLite connection fails).
    • Fixed bug #49267 (Linking fails for iconv).
    • Fixed bug #48601 (xpath() returns FALSE for legitimate query).
    • Fixed bug #48289 (iconv_mime_encode() quoted-printable scheme is broken). .
    • Fixed bug #43314 (iconv_mime_encode(), broken Q scheme).
    • Fixed bug #33210 (getimagesize() fails to detect width/height on certain JPEGs).
    • Fixed bug #23229 (syslog() truncates messages).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top