PHP Release 5.3.1


    PHP 5.3.1 Release Announcement

    The PHP development team is proud to announce the immediate release of PHP 5.3.1. This is a maintenance release in the 5.3 series, which includes a large number of bug fixes.

    Security Enhancements and Fixes in PHP 5.3.1:

    • Added "max_file_uploads" INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion.
    • Added missing sanity checks around exif processing.
    • Fixed a safe_mode bypass in tempnam().
    • Fixed a open_basedir bypass in posix_mkfifo().
    • Fixed bug #50063 (safe_mode_include_dir fails).
    • Fixed bug #44683 (popen crashes when an invalid mode is passed).

    Key Bug Fixes in PHP 5.3.1 include:

    • Fixed crash in com_print_typeinfo when an invalid typelib is given.
    • Fixed crash in SQLiteDatabase::ArrayQuery() and SQLiteDatabase::SingleQuery() when calling using Reflection.
    • Fixed crash when instantiating PDORow and PDOStatement through Reflection.
    • Fixed bug #49910 (no support for ././@LongLink for long filenames in phar tar support).
    • Fixed bug #49908 (throwing exception in __autoload crashes when interface is not defined).
    • Around 100 other bug fixes

    For users upgrading from PHP 5.2 there is a migration guide available here, detailing the changes between those releases and PHP 5.3.

    For a full list of changes in PHP 5.3.1, see the ChangeLog.

    Source Code
    Change Logs
    fixed crash in sqlitedatabase
    • Fixed certificate validation inside php_openssl_apply_verification_policy (Ryan Sleevi, Ilia) when calling using Reflection.
    • Fixed crash when instantiating PDORow and PDOStatement through Reflection.
    • Fixed sanity check for the color index in imagecolortransparent.
    • Fixed scandir/readdir when used mounted points on Windows.
    • Fixed zlib.deflate compress filter to actually accept level parameter.
    • Fixed leak on error in popen/exec (and related functions) on Windows.
    • Fixed possible bad caching of symlinked directories in the realpath cache on Windows.
    • Fixed atime and mtime in stat related functions on Windows.
    • Fixed spl_autoload_unregister/spl_autoload_functions wrt. Closures and Functors.
    • Fixed open_basedir circumvention for "mail.log" ini directive.
    • Fixed signature generation/validation for zip archives in ext/phar.
    • Fixed memory leak in stream_is_local().
    • Fixed BC break in mime_content_type(), removes the content encoding.
    • Fixed PECL bug #16842 (oci_error return false when NO_DATA_FOUND is raised).
    • Fixed bug #50063 (safe_mode_include_dir fails).
    • Fixed bug #50052 (Different Hashes on Windows and Linux on wrong Salt size).
    • Fixed bug #49986 (Missing ICU DLLs on windows package).
    • Fixed bug #49910 (no support for ././@LongLink for long filenames in phar tar support).
    • Fixed bug #49908 (throwing exception in __autoload crashes when interface is not defined).
    • Fixed bug #49847 (exec() fails to return data inside 2nd parameter, given output lines >4095 bytes).
    • Fixed bug #49809 (time_sleep_until() is not available on OpenSolaris).
    • Fixed bug #49757 (long2ip() can return wrong value in a multi-threaded applications).
    • Fixed bug #49738 (calling mcrypt after mcrypt_generic_deinit crashes).
    • Fixed bug #49732 (crashes when using fileinfo when timestamp conversion fails).
    • Fixed bug #49698 (Unexpected change in strnatcasecmp()).
    • Fixed bug #49630 (imap_listscan function missing).
    • Fixed bug #49572 (use of C++ style comments causes build failure).
    • Fixed bug #49531 (CURLOPT_INFILESIZE sometimes causes warning "CURLPROTO_FILE cannot be set").
    • Fixed bug #49517 (cURL's CURLOPT_FILE prevents file from being deleted after fclose).
    • Fixed bug #49470 (FILTER_SANITIZE_EMAIL allows disallowed characters).
    • Fixed bug #49447 (php engine need to correctly check for socket API return status on windows).
    • Fixed bug #49391 (ldap.c utilizing deprecated ldap_modify_s).
    • Fixed bug #49372 (segfault in php_curl_option_curl).
    • Fixed bug #49361 (wordwrap() wraps incorrectly on end of line boundaries).
    • Fixed bug #49306 (inside pdo_mysql default socket settings are ignored).
    • Fixed bug #49289 (bcmath module doesn't compile with phpize configure).
    fixed bug #49286 (php
    • Fixed bug #49269 (Ternary operator fails on Iterator object when used inside foreach declaration).
    • Fixed bug #49236 (Missing PHP_SUBST(PDO_MYSQL_SHARED_LIBADD)).
    • Fixed bug #49223 (Inconsistency using get_defined_constants).
    • Fixed bug #49193 (gdJpegGetVersionString() inside gd_compact identifies wrong type in declaration).
    • Fixed bug #49183 (dns_get_record does not return NAPTR records).
    • Fixed bug #49144 (Import of schema from different host transmits original authentication details).
    • Fixed bug #49142 (crash when exception thrown from __tostring()).
    • Fixed bug #49132 (posix_times returns false without error).
    • Fixed bug #49125 (Error in dba_exists C code).
    • Fixed bug #49122 (undefined reference to mysqlnd_stmt_next_result on compile with --with-mysqli and MySQL 6.0).
    • Fixed bug #49108 (2nd scan_dir produces segfault).
    • Fixed bug #49098 (mysqli segfault on error).
    • Fixed bug #49095 (proc_get_status['exitcode'] fails on win32).
    • Fixed bug #49092 (ReflectionFunction fails to work with functions in fully qualified namespaces).
    • Fixed bug #49074 (private class static fields can be modified by using reflection).
    • Fixed bug #49072 (feof never returns true for damaged file in zip).
    • Fixed bug #49065 ("disable_functions" php.ini option does not work on Zend extensions).
    fixed bug #49064 (--enable-session=shared does not work
    • Fixed bug #49056 (parse_ini_file() regression in 5.3.0 when using non-ASCII strings as option keys).
    • Fixed bug #49052 (context option headers freed too early when using --with-curlwrappers).
    • Fixed bug #49047 (The function touch() fails on directories on Windows).
    fixed bug #49032 (splfileobject
    • Fixed bug #49027 (mysqli_options() doesn't work when using mysqlnd).
    • Fixed bug #49026 (proc_open() can bypass safe_mode_protected_env_vars restrictions).
    • Fixed bug #49020 (phar misinterprets ustar long filename standard).
    • Fixed bug #49018 (phar tar stores long filenames wit prefix/name reversed).
    • Fixed bug #49014 (dechunked filter broken when serving more than 8192 bytes in a chunk).
    • Fixed bug #49012 (phar tar signature algorithm reports as Unknown (0) in getSignature() call).
    • Fixed bug #49000 (PHP CLI in Interactive mode (php -a) crashes when including files from function).
    • Fixed bug #48994 (zlib.output_compression does not output HTTP headers when set to a string value).
    • Fixed bug #48980 (Crash when compiling with pdo_firebird).
    • Fixed bug #48962 (cURL does not upload files with specified filename).
    • Fixed bug #48929 (Double \r\n after HTTP headers when "header" context option is an array).
    • Fixed bug #48913 (Too long error code strings in pdo_odbc driver).
    • Fixed bug #48912 (Namespace causes unexpected strict behaviour with extract()).
    • Fixed bug #48909 (Segmentation fault in mysqli_stmt_execute()).
    • Fixed bug #48899 (is_callable returns true even if method does not exist in parent class).
    • Fixed bug #48893 (Problems compiling with Curl).
    • Fixed bug #48880 (Random Appearing open_basedir problem).
    fixed bug #48872 (string.c
    • Fixed bug #48854 (array_merge_recursive modifies arrays after first one).
    • Fixed bug #48805 (IPv6 socket transport is not working).
    • Fixed bug #48802 (printf() returns incorrect outputted length).
    • Fixed bug #48791 (open office files always reported as corrupted).
    • Fixed bug #48788 (RecursiveDirectoryIterator doesn't descend into symlinked directories).
    • Fixed bug #48783 (make install will fail saying phar file exists).
    • Fixed bug #48774 (SIGSEGVs when using curl_copy_handle()).
    • Fixed bug #48771 (rename() between volumes fails and reports no error on Windows).
    • Fixed bug #48768 (parse_ini_*() crash with INI_SCANNER_RAW).
    • Fixed bug #48763 (ZipArchive produces corrupt archive).
    • Fixed bug #48762 (IPv6 address filter still rejects valid address).
    fixed bug #48757 (reflectionfunction
    • Fixed bug #48754 (mysql_close() crash php when no handle specified).
    • Fixed bug #48752 (Crash during date parsing with invalid date).
    • Fixed bug #48746 (Unable to browse directories within Junction Points).
    fixed bug #48745 (mysqlnd
    • Fixed bug #48740 (PHAR install fails when INSTALL_ROOT is not the final install location).
    • Fixed bug #48733 (CURLOPT_WRITEHEADER|CURLOPT_FILE|CURLOPT_STDERR warns on files that have been opened with r+).
    fixed bug #48719 (parse_ini_*()
    • Fixed bug #48718 (FILTER_VALIDATE_EMAIL does not allow numbers in domain components).
    • Fixed bug #48681 (openssl signature verification for tar archives broken).
    fixed bug #48660 (parse_ini_*()
    • Fixed bug #48645 (mb_convert_encoding() doesn't understand hexadecimal html-entities).
    • Fixed bug #48637 ("file" fopen wrapper is overwritten when using --with-curlwrappers).
    • Fixed bug #48608 (Invalid libreadline version not detected during configure).
    • Fixed bug #48400 (imap crashes when closing stream opened with OP_PROTOTYPE flag).
    • Fixed bug #48377 (error message unclear on converting phar with existing file).
    • Fixed bug #48247 (Infinite loop and possible crash during startup with errors when errors are logged).
    fixed bug #48198 error
    • Fixed bug #48189 (ibase_execute error in return param).
    • Fixed bug #48182 (ssl handshake fails during asynchronous socket connection).
    • Fixed bug #48116 (Fixed build with Openssl 1.0).
    • Fixed bug #48057 (Only the date fields of the first row are fetched, others are empty).
    • Fixed bug #47481 (natcasesort() does not sort extended ASCII characters correctly).
    • Fixed bug #47351 (Memory leak in DateTime).
    • Fixed bug #47273 (Encoding bug in SoapServer->fault).
    • Fixed bug #46682 (touch() afield returns different values on windows).
    • Fixed bug #46614 (Extended MySQLi class gives incorrect empty() result).
    • Fixed bug #46020 (with Sun Java System Web Server 7.0 on HPUX, #define HPUX).
    • Fixed bug #45905 (imagefilledrectangle() clipping error).
    • Fixed bug #45554 (Inconsistent behavior of the u format char).
    • Fixed bug #45141 (setcookie will output expires years of >4 digits).
    • Fixed bug #44683 (popen crashes when an invalid mode is passed).
    • Fixed bug #43510 (stream_get_meta_data() does not return same mode as used in fopen).
    • Fixed bug #42434 (ImageLine w/ antialias = 1px shorter).
    • Fixed bug #40013 (php_uname() does not return nodename on Netware
    • Fixed bug #38091 (Mail() does not use FQDN when sending SMTP helo).
    • Fixed bug #28038 (Sent incorrect RCPT TO commands to SMTP server)
    • Fixed bug #27051 (Impersonation with FastCGI does not exec process as impersonated user).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top