PHP Release 5.5.28


    PHP 5.5.28 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.5.28. 12 security-related issues were fixed in this release. All PHP 5.5 users are encouraged to upgrade to this version.

    According to our release calendar, this PHP 5.5 version is the first security release of the PHP 5.5 branch. This and all the following releases of this branch do not contain bugfixes that are not considered relevant for security. PHP 5.5 users that need further bugfixes are encouraged to upgrade to PHP 5.6.

    For source downloads of PHP 5.5.28 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.5.28 (tar.bz2)
    SHA256: 197d2c572e030c177e53d3763d59ac6d363d7c78dc22e6cc1e2ac65573d9c2f3
    PHP 5.5.28 (tar.gz)
    SHA256: 6084f25a39ab2f79ade46bf0258a1cd6c9bbb09a106b40dd996dbdf8cd3b08f2
    PHP 5.5.28 (tar.xz)
    SHA256: d060455c804c622cda9f3f5f084b10c6ceba73ee76c1720897e17137a0f75ecd
    Change Logs
    core
    • Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive method calls).
    • Fixed bug #69892 (Different arrays compare indentical due to integer key truncation).
    • Fixed bug #70002 (TS issues with temporary dir handling).
    • Fixed bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref).
    openssl
    • Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure). (CVE-2015-8867)
    phar
    • Improved fix for bug #69441.
    • Fixed bug #70019 (Files extracted from archive may be placed outside of destination directory). (CVE-2015-6833)
    soap
    • Fixed bug #70081 (SoapClient info leak / null pointer dereference via multiple type confusions).
    spl
    • Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items). (CVE-2015-6832)
    • Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject). (CVE-2015-6831)
    • Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6831)
    • Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6831)
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top