PHP Release 5.4.32


    PHP 5.4.32 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.4.32. 16 bugs were fixed in this release, including the following security-related issues: CVE-2014-2497, CVE-2014-3538, CVE-2014-3587, CVE-2014-3597, CVE-2014-4670, CVE-2014-4698, CVE-2014-5120. All PHP 5.4 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.4.32 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.4.32 (tar.bz2)
    SHA256: 26d0717669a098f18cd22dc3ae8282101d38508054500c26775ddcc26ca7c826
    PHP 5.4.32 (tar.gz)
    SHA256: 80ebdf34f91b8e1d516080363804137177368777aa9ecffee600f2957e8b0f94
    Change Logs
    com
    • Fixed missing type checks in com_event_sink.
    • Fixed bug #41577 (DOTNET is successful once per server run).
    fileinfo
    • Fixed bug #67705 (extensive backtracking in rule regular expression). (CVE-2014-3538)
    • Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587)
    gd
    • Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference). (CVE-2014-2497).
    • Fixed bug #67730 (Null byte injection possible with imagexxx functions). (CVE-2014-5120)
    litespeed
    • Updated LiteSpeed SAPI code from V5.5 to V6.6
    network
    • Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597)
    milter
    • Fixed bug #67715 (php-milter does not build and crashes randomly).
    openssl
    • Fixed missing type checks in OpenSSL options .
    readline
    • Fixed bug #55496 (Interactive mode doesn't force a newline before the prompt).
    • Fixed bug #67496 (Save command history when exiting interactive shell with control-c).
    sessions
    • Fixed missing type checks in php_session_create_id. .
    spl
    • Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting). (CVE-2014-4698)
    • Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670)
    core
    • Fixed bug #67693 (incorrect push to the empty array)
    odbc
    • Fixed bug #60616 (odbc_fetch_into returns junk data at end of multi-byte char fields).
    mysqli
    • Fixed bug #67839 (mysqli does not handle 4-byte floats correctly).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top