PHP Release 5.5.14


    PHP 5.5.14 Release Announcement

    The PHP Development Team announces the immediate availability of PHP 5.5.14. This release fixes several bugs against PHP 5.5.13. Also, this release fixes a total of 8 CVEs, half of them concerning the FileInfo extension.

    All PHP users are encouraged to upgrade to this new version.

    Please, note that this release also fixes a backward compatibility issue that has been detected in the PHP 5.5.13 release. Still, the fix in PHP 5.5.14 may break some very rare situations. As this tiny compatibility break involves security, and as security is our primary concern, we had to fix it. This concerns bug 67072. For more information about this bug and its actual resolution, please visit our upgrading guide. We apologize for any inconvenience you may have experienced with this behavior.

    For source downloads of PHP 5.5.14, please visit our downloads page. Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.5.14 (tar.bz2)
    SHA256: df5a057877f827549e0a60b43fb01e4bd440814bcf04fbd70bacbddf74482610
    PHP 5.5.14 (tar.gz)
    SHA256: ef7e4f4942c5767e01b96650a5bd4178c663738436f99b5695c3144732ff7166
    Change Logs
    core
    • Fixed BC break introduced by patch for bug #67072.
    • Fixed bug #66622 (Closures do not correctly capture the late bound class (static::) in some cases).
    • Fixed bug #67390 (insecure temporary file use in the configure script). (Remi)
    • Fixed bug #67399 (putenv with empty variable may lead to crash).
    cli server
    • Fixed Bug #67406 (built-in web-server segfaults on startup).
    date
    • Fixed bug #67308 (Serialize of DateTime truncates fractions of second).
    • Fixed regression in fix for bug #67118 (constructor can't be called twice).
    fileinfo
    • Fixed bug #67326 .
    • Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal string size).
    • Fixed bug #67411 (fileinfo: cdf_check_stream_offset insufficient boundary check).
    • Fixed bug #67412 (fileinfo: cdf_count_chain insufficient boundary check).
    • Fixed bug #67413 (fileinfo: cdf_read_property_info insufficient boundary check).
    litespeed
    • Updated LiteSpeed SAPI code from V5.5 to V6.6
    network
    • Fixed bug #67432 (Fix potential segfault in dns_get_record()). (CVE-2014-4049).
    opcache
    • Fixed issue #183 (TMP_VAR is not only used once).
    openssl
    • Fixed bug #65698 (certificates validity parsing does not work past 2050).
    • Fixed bug #66636 (openssl_x509_parse warning with V_ASN1_GENERALIZEDTIME).
    pdo-odbc
    soap
    • Implemented FR #49898 (Add SoapClient::__getCookies()).
    spl
    • Fixed bug #66127 (Segmentation fault with ArrayObject unset).
    • Fixed bug #67359 (Segfault in recursiveDirectoryIterator).
    • Fixed bug #67360 (Missing element after ArrayObject::getIterator).
    • Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion). (CVE-2014-3515)
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top