PHP Release 5.3.29

    PHP 5.3.29 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.3.29. This release marks the end of life of the PHP 5.3 series. Future releases of this series are not planned. All PHP 5.3 users are encouraged to upgrade to the current stable version of PHP 5.5 or previous stable version of PHP 5.4, which are supported till at least 2016 and 2015 respectively.

    PHP 5.3.29 contains about 25 potentially security related fixes backported from PHP 5.4 and 5.5.

    For source downloads of PHP 5.3.29, please visit our downloads page. Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    For helping your migration to newer versions please refer to our migration guides for updates from PHP 5.3 to 5.4 and from PHP 5.4 to 5.5.

    Source Code
    PHP 5.3.29 (tar.bz2)
    SHA256: c4e1cf6972b2a9c7f2777a18497d83bf713cdbecabb65d3ff62ba441aebb0091
    PHP 5.3.29 (tar.gz)
    SHA256: 57cf097de3d6c3152dda342f62b1b2e9c988f4cfe300ccfe3c11f3c207a0e317
    PHP 5.3.29 (tar.xz)
    SHA256: 8438c2f14ab8f3d6cd2495aa37de7b559e33b610f9ab264f0c61b531bf0c262d
    Change Logs
    core
    • Fixed bug #66127 (Segmentation fault with ArrayObject unset).
    • Fixed bug #67247 (spl_fixedarray_resize integer overflow).
    • Fixed bug #67249 (printf out-of-bounds read).
    • Fixed bug #67250 (iptcparse out-of-bounds read).
    • Fixed bug #67252 (convert_uudecode out-of-bounds read).
    • Fixed bug #67359 (Segfault in recursiveDirectoryIterator).
    • Fixed bug #67390 (insecure temporary file use in the configure script). (Remi)
    • Fixed bug #67399 (putenv with empty variable may lead to crash).
    • Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion) (CVE-2014-3515).
    • Fixed bug #67498 (phpinfo() Type Confusion Information Leak Vulnerability).
    com
    • Fixed missing type checks in com_event_sink .
    date
    • Fixed bug #66060 (Heap buffer over-read in DateInterval). (CVE-2013-6712)
    • Fixed bug #67251 (date_parse_from_format out-of-bounds read).
    • Fixed bug #67253 (timelib_meridian_with_check out-of-bounds read).
    exif
    • Fixed bug #65873 (Integer overflow in exif_read_data()).
    fileinfo
    • Fixed bug #66307 (Fileinfo crashes with powerpoint files).
    • Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary check).
    • Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS).
    • Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation).
    • Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal string size).
    • Fixed bug #67411 (fileinfo: cdf_check_stream_offset insufficient boundary check).
    • Fixed bug #67412 (fileinfo: cdf_count_chain insufficient boundary check).
    • Fixed bug #67413 (fileinfo: cdf_read_property_info insufficient boundary check).
    intl
    • Fixed bug #67349 (Locale::parseLocale Double Free).
    • Fixed bug #67397 (Buffer overflow in locale_get_display_name and uloc_getDisplayName (libicu 4.8.1)).
    network
    • Fixed bug #67432 (Fix potential segfault in dns_check_record()). (CVE-2014-4049).
    openssl
    • Fixed missing type checks in OpenSSL options .
    session
    • Fixed missing type checks in php_session_create_id .
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top