PHP Release 5.4.28


    PHP 5.4.28 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.4.28. 19 bugs were fixed in this release, including CVE-2014-0185. All PHP 5.4 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.4.28 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.4.28 (tar.bz2)
    SHA256: 3fe780e5179e90c4d37276e79acc0d0692f1bc0911985af694b92c664c0ef3c4
    PHP 5.4.28 (tar.gz)
    SHA256: 5140292c94a0301db7a807e6b3aadf6ee966346d0005aa3d15464bd4c595a786
    Change Logs
    core
    • Fixed bug #61019 (Out of memory on command stream_get_contents).
    • Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace UNIX sockets).
    • Fixed bug #66171 (Symlinks and session handler allow open_basedir bypass).
    • Fixed bug #66182 (exit in stream filter produces segfault).
    • Fixed bug #66736 (fpassthru broken).
    • Fixed bug #67024 (getimagesize should recognize BMP files with negative height).
    • Fixed bug #67033 (Remove reference to Windows 95).
    curl
    • Fixed bug #66562 (curl_exec returns differently than curl_multi_getcontent).
    date
    • Fixed bug #66721 (__wakeup of DateTime segfaults when invalid object data is supplied).
    embed
    • Fixed bug #65715 (php5embed.lib isn't provided anymore).
    fileinfo
    • Fixed bug #66987 (Memory corruption in fileinfo ext / bigendian).
    fpm
    • Fixed bug #66482 .
    • Fixed bug #67060 (sapi/fpm: possible privilege escalation due to insecure default configuration) (CVE-2014-0185).
    json
    • Fixed bug #66021 (Blank line inside empty array/object when JSON_PRETTY_PRINT is set).
    ldap
    • Fixed issue with null bytes in LDAP bindings.
    openssl
    • Fix bug #66942 (memory leak in openssl_seal()).
    • Fix bug #66952 (memory leak in openssl_open()).
    simplexml
    • Fixed bug #66084 (simplexml_load_string() mangles empty node name)
    xsl
    • Fixed bug #53965 (<xsl:include> cannot find files with relative paths when loaded with "file://").
    apache2 handler sapi
    • Fixed Apache log issue caused by APR's lack of support for %zu (APR issue https://issues.apache.org/bugzilla/show_bug.cgi?id=56120).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top