PHP Release 5.5.2


    PHP 5.5.2 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.5.2. About 20 bugs were fixed, including security issue in OpenSSL module (CVE-2013-4248) and session fixation problem (CVE-2011-4718).

    NOTE: Please do not use this release, due to the bug in the fix for CVE-2013-4248. This bug is fixed in PHP 5.5.3.

    For source downloads of PHP 5.5.2 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    Change Logs
    core
    • Fixed bug #65372 (Segfault in gc_zval_possible_root when return reference fails).
    • Fixed value of FILTER_SANITIZE_FULL_SPECIAL_CHARS constant (previously was erroneously set to FILTER_SANITIZE_SPECIAL_CHARS value). .
    • Fixed bug #65304 (Use of max int in array_sum).
    • Fixed bug #65291 (get_defined_constants() causes PHP to crash in a very limited case).
    • Fixed bug #62691 (solaris sed has no -i switch).
    • Fixed bug #61345 (CGI mode - make install don't work).
    • Fixed bug #61268 (--enable-dtrace leads make to clobber Zend/zend_dtrace.d)
    dom
    • Added flags option to DOMDocument::schemaValidate() and DOMDocument::schemaValidateSource(). Added LIBXML_SCHEMA_CREATE flag.
    opcache
    • Added opcache.restrict_api configuration directive that may limit usage of OPcache API functions only to particular script(s).
    • Added support for glob symbols in blacklist entries (?, *, **).
    • Fixed bug #65338 (Enabling both php_opcache and php_wincache AVs on shutdown).
    openssl
    • Fixed handling null bytes in subjectAltName (CVE-2013-4248).
    pdo_mysql
    • Fixed bug #65299 (pdo mysql parsing errors).
    pgsql
    • Fixed bug #62978 (Disallow possible SQL injections with pg_select()/pg_update() /pg_delete()/pg_insert()).
    • Fixed bug #65336 (pg_escape_literal/identifier() scilently returns false).
    phar
    • Fixed bug #65028 (Phar::buildFromDirectory creates corrupt archives for some specific contents).
    sessions
    • Implemented strict sessions RFC (https://wiki.php.net/rfc/strict_sessions) which protects against session fixation attacks and session collisions. (CVE-2011-4718).
    • Fixed possible buffer overflow under Windows. Note: Not a security fix.
    • Changed session.auto_start to PHP_INI_PERDIR.
    soap
    • Fixed bug #65018 (SoapHeader problems with SoapServer).
    spl
    • Fixed bug #65328 (Segfault when getting SplStack object Value).
    • Added RecursiveTreeIterator setPostfix and getPostifx methods.
    • Fixed bug #61697 (spl_autoload_functions returns lambda functions incorrectly).
    streams
    • Fixed bug #65268 (select() implementation uses outdated tick API).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top