PHP Release 5.3.11


    PHP 5.3.11 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.3.11. This release focuses on improving the stability of the PHP 5.3 branch with over 60 bug fixes, some of which are security related.

    Security Enhancements for PHP 5.3.11:

    • Fixed bug #61043 (Regression in magic_quotes_gpc fix for CVE-2012-0831). Reported by Stefan Esser. (Ondřej Surý)
    • Fixed bug #54374 (Insufficient validating of upload name leading to corrupted $_FILES indices). (CVE-2012-1172). (Stas, lekensteyn at gmail dot com, Pierre)
    • Add open_basedir checks to readline_write_history and readline_read_history. (Rasmus, reported by Mateusz Goik)

    Key enhancements in PHP 5.3.11 include:

    • Added debug info handler to DOM objects. (Gustavo, Joey Smith)
    • Fixed bug #61172 (Add Apache 2.4 support). (Chris Jones)

    For a full list of changes in PHP 5.3.11, see the ChangeLog. For source downloads please visit our downloads page, Windows binaries can be found on windows.php.net/download/.

    All users of PHP 5.3 are strongly encouraged to upgrade to PHP 5.3.11.

    Source Code
    Change Logs
    core
    • Fixed bug #61650 (ini parser crashes when using ${xxxx} ini variables (without apache2)).
    • Fixed bug #61273 (call_user_func_array with more than 16333 arguments leaks / crashes).
    • Fixed bug #61165 (Segfault - strip_tags()).
    • Improved max_input_vars directive to check nested variables .
    • Fixed bug #61095 (Incorect lexing of 0x00*+<NUM>).
    • Fixed bug #61087 (Memory leak in parse_ini_file when specifying invalid scanner mode).
    • Fixed bug #61072 (Memory leak when restoring an exception handler).
    • Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX).
    • Fixed bug #61043 (Regression in magic_quotes_gpc fix for CVE-2012-0831).
    • Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical vars).
    • Fixed bug #60895 (Possible invalid handler usage in windows random functions).
    • Fixed bug #60825 (Segfault when running symfony 2 tests).
    • Fixed bug #60801 (strpbrk() mishandles NUL byte).
    • Fixed bug #60569 (Nullbyte truncates Exception $message).
    • Fixed bug #60227 (header() cannot detect the multi-line header with CR).
    • Fixed bug #60222 (time_nanosleep() does validate input params).
    • Fixed bug #54374 (Insufficient validating of upload name leading to corrupted $_FILES indices). (CVE-2012-1172).
    • Fixed bug #52719 (array_walk_recursive crashes if third param of the function is by reference).
    • Fixed bug #51860 (Include fails with toplevel symlink to /).
    • DOM
    • Added debug info handler to DOM objects.
    • FPM
    • Fixed bug #61430 (Transposed memset() params in sapi/fpm/fpm/fpm_shm.c).
    • Ibase
    • Fixed bug #60947 (Segmentation fault while executing ibase_db_info).
    • Installation
    • Fixed bug #61172 (Add Apache 2.4 support).
    • Fileinfo
    • Upgraded libmagic to 5.11
    • Fixed bug #61565 where php_stream_open_wrapper_ex tries to open a directory descriptor under windows.
    • Fixed bug #61566 failure caused by the posix lseek and read versions under windows in cdf_read().
    • Fixed bug #61173 (Unable to detect error from finfo constructor).
    firebird database extension (ibase)
    • Fixed bug #60802 gives segfault when passing params).
    libxml
    • Fixed bug #61367 (open_basedir bypass using libxml RSHUTDOWN).
    • mysqli
    • Fixed bug #61003 (mysql_stat() require a valid connection). .
    • PDO_mysql
    • Fixed bug #61207 (PDO::nextRowset() after a multi-statement query doesn't always work).
    • Fixed bug #61194 (PDO should export compression flag with myslqnd).
    • PDO_odbc
    • Fixed bug #61212 (PDO ODBC Segfaults on SQL_SUCESS_WITH_INFO).
    • PDO_pgsql
    • Fixed bug #61267 (pdo_pgsql's PDO::exec() returns the number of SELECTed rows on postgresql >= 9).
    pdo_sqlite extension
    • Add createCollation support.
    pgsql
    • Fixed bug #60718 (Compile problem with libpq (PostgreSQL 7.3 or less).
    phar
    • Fixed bug #61184 (Phar::webPhar() generates headers with trailing NUL bytes).
    php-fpm sapi
    • Fixed bug #60811 (php-fpm compilation problem).
    readline
    • Fixed bug #61088 (Memory leak in readline_callback_handler_install).
    • Add open_basedir checks to readline_write_history and readline_read_history.
    reflection
    • Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads when get_properties returns a hash table with (inaccessible) dynamic numeric properties).
    • Fixed bug #60968 (Late static binding doesn't work with ReflectionMethod::invokeArgs()).
    • SOAP
    • Fixed basic HTTP authentication for WSDL sub requests.
    • Fixed bug #60887 (SoapClient ignores user_agent option and sends no User-Agent header).
    • Fixed bug #60842, #51775 (Chunked response parsing error when chunksize length line is > 10 bytes).
    • Fixed bug #49853 (Soap Client stream context header option ignored).
    • SPL
    • Fixed memory leak when calling SplFileInfo's constructor twice.
    • Fixed bug #61418 (Segmentation fault when DirectoryIterator's or FilesystemIterator's iterators are requested more than once without having had its dtor callback called in between).
    • Fixed bug #61347 (inconsistent isset behavior of Arrayobject).
    • Fixed bug #61326 (ArrayObject comparison).
    sqlite3 extension
    • Add createCollation() method.
    session
    • Fixed bug #60860 (session.save_handler=user without defined function core dumps).
    • Fixed bug #60634 (Segmentation fault when trying to die() in SessionHandler::write()).
    streams
    • Fixed bug #61371 (stream_context_create() causes memory leaks on use streams_socket_create).
    • Fixed bug #61253 (Wrappers opened with errors concurrency problem on ZTS).
    • Fixed bug #61115 (stream related segfault on fatal error in php_stream_context_link).
    • Fixed bug #60817 (stream_get_line() reads from stream even when there is already sufficient data buffered). stream_get_line() now behaves more like fgets(), as is documented.
    • Further fix for bug #60455 (stream_get_line misbehaves if EOF is not detected together with the last read).
    • Fixed bug #60106 (stream_socket_server silently truncates long unix socket paths).
    tidy
    • Fixed bug #54682 (tidy null pointer dereference).
    xmlrpc
    • Fixed bug #61264 (xmlrpc_parse_method_descriptions leaks temporary variable).
    • Fixed bug #61097 (Memory leak in xmlrpc functions copying zvals).
    zlib
    • Fixed bug #61139 (gzopen leaks when specifying invalid mode).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top