5.4 has reached end-of-life and will no longer receive
bugfixes or security patches from the PHP Project.
Some downstream distributions may still continue to provide
backported fixes for a time, depending on their support policy.
For more information please see our
support policy.
The latest release of PHP 5.4 is
5.4.45.
PHP 5.4.30 Release Announcement
The PHP development team announces the immediate availability of PHP
5.4.30. Over 20 bugs were fixed in this release, including the following security issues:
CVE-2014-3981, CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487,
CVE-2014-4049, CVE-2014-3515.
All PHP 5.4 users are encouraged to upgrade to this version.
Please, note that this release also fixes a backward compatibility issue that has been
detected in the PHP 5.4.29 release. Still, the fix in PHP 5.4.30 may break some very rare
situations. As this tiny compatibility break involves security, and as security is our primary
concern, we had to fix it. This concerns
bug 67072. For more information about
this bug and its actual resolution, please refer to our
upgrading guide, section 4a.
We apologize for any inconvenience you may have experienced with this behavior.
For source downloads of PHP 5.4.30 please visit our downloads page,
Windows binaries can be found on windows.php.net/download/.
The list of changes is recorded in the ChangeLog.
core
- Fixed BC break introduced by patch for bug #67072.
- Fixed bug #66622 (Closures do not correctly capture the late bound class (static::) in some cases).
- Fixed bug #67390 (insecure temporary file use in the configure script). (Remi)
- Fixed bug #67399 (putenv with empty variable may lead to crash).
- Fixed bug #67498 (phpinfo() Type Confusion Information Leak Vulnerability).
cli server
- Fixed Bug #67406 (built-in web-server segfaults on startup).
date
- Fixed bug #67308 (Serialize of DateTime truncates fractions of second).
- Fixed regression in fix for bug #67118 (constructor can't be called twice).
fileinfo
- Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary check).
- Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal string size). (CVE-2014-3478)
- Fixed bug #67411 (fileinfo: cdf_check_stream_offset insufficient boundary check). (CVE-2014-3479)
- Fixed bug #67412 (fileinfo: cdf_count_chain insufficient boundary check). (CVE-2014-3480)
- Fixed bug #67413 (fileinfo: cdf_read_property_info insufficient boundary check). (CVE-2014-3487)
intl
- Fixed bug #67349 (Locale::parseLocale Double Free).
- Fixed bug #67397 (Buffer overflow in locale_get_display_name and uloc_getDisplayName (libicu 4.8.1)).
network
- Fixed bug #67432 (Fix potential segfault in dns_get_record()). (CVE-2014-4049).
openssl
- Fixed bug #65698 (certificates validity parsing does not work past 2050).
- Fixed bug #66636 (openssl_x509_parse warning with V_ASN1_GENERALIZEDTIME).
soap
- Implemented FR #49898 (Add SoapClient::__getCookies()).
spl
- Fixed bug #66127 (Segmentation fault with ArrayObject unset).
- Fixed bug #67359 (Segfault in recursiveDirectoryIterator).
- Fixed bug #67360 (Missing element after ArrayObject::getIterator).
- Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion) (CVE-2014-3515).
