PHP Release 5.4.4


    PHP 5.4.4 Release Announcement

    The PHP development team would like to announce the immediate availability of PHP 5.4.4. This release fixes two security related issues. All users of PHP are encouraged to upgrade to this release.

    PHP 5.4.4 fixes an security issue in the implementation of crypt() and a heap overflow in the Phar extension. Over 30 bugs were fixed

    Please note that php://fd is now only available if the CLI SAPI is used

    For source downloads of PHP 5.4.4 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    Change Logs
    com
    • Fixed bug #62146 com_dotnet cannot be built shared.
    cli server
    • Implemented FR #61977 (Need CLI web-server support for files with .htm & svg extensions).
    • Improved performance while sending error page, this also fixed bug #61785 (Memory leak when access a non-exists file without router).
    • Fixed bug #61546 (functions related to current script failed when chdir() in cli sapi).
    core
    • Fixed missing bound check in iptcparse().
    • Fixed CVE-2012-2143.
    • Fixed bug #62097 (fix for for bug #54547).
    • Fixed bug #62005 (unexpected behavior when incrementally assigning to a member of a null object).
    • Fixed bug #61978 (Object recursion not detected for classes that implement JsonSerializable).
    • Fixed bug #61991 (long overflow in realpath_cache_get()).
    • Fixed bug #61922 (ZTS build doesn't accept zend.script_encoding config).
    • Fixed bug #61827 (incorrect \e processing on Windows)
    • Fixed bug #61782 (__clone/__destruct do not match other methods when checking access controls).
    • Fixed bug #61764 ('I' unpacks n as signed if n > 2^31-1 on LP64).
    • Fixed bug #61761 ('Overriding' a private static method with a different signature causes crash).
    • Fixed bug #61730 (Segfault from array_walk modifying an array passed by reference).
    • Fixed bug #61728 (PHP crash when calling ob_start in request_shutdown phase).
    • Fixed bug #61713 (Logic error in charset detection for htmlentities).
    • Fixed bug #61660 (bin2hex(hex2bin($data)) != $data).
    • Fixed bug #61650 (ini parser crashes when using ${xxxx} ini variables (without apache2)).
    • Fixed bug #61605 (header_remove() does not remove all headers).
    • Fixed bug #54547 (wrong equality of string numbers).
    • Fixed bug #54197 ([PATH=] sections incompatibility with user_ini.filename set to null).
    • Changed php://fd to be available only for CLI.
    curl
    • Fixed bug #61948 (CURLOPT_COOKIEFILE '' raises open_basedir restriction).
    • Fileinfo
    • Fixed bug #61812 (Uninitialised value used in libmagic).
    • Fixed bug #61566 failure caused by the posix lseek and read versions under windows in cdf_read().
    • Fixed bug #61565 where php_stream_open_wrapper_ex tries to open a directory descriptor under windows.
    • Intl
    • Fixed bug #62082 (Memory corruption in internal function get_icu_disp_value_src_php()).
    libxml
    • Fixed bug #61617 (Libxml tests failed(ht is already destroyed)).
    pdo
    • Fixed bug #61755 (A parsing bug in the prepared statements can lead to access violations).
    phar
    • Fixed bug #61065 (Secunia SA44335, CVE-2012-2386).
    pgsql
    • Added pg_escape_identifier/pg_escape_literal.
    streams
    • Fixed bug #61961 (file_get_contents leaks when access empty file with maxlen set).
    zlib
    • Fixed bug #61820 (using ob_gzhandler will complain about headers already sent when no compression).
    • Fixed bug #61443 (can't change zlib.output_compression on the fly).
    • Fixed bug #60761 (zlib.output_compression fails on refresh).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top