PHP Release 5.5.38

PHP 5.5.38 Release Announcement

The PHP development team announces the immediate availability of PHP 5.5.38. This is a security release that fixes some security related bugs.

All PHP 5.5 users are encouraged to upgrade to this version.

For source downloads of PHP 5.5.38 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

Note that according to our release schedule, PHP 5.5.38 is the last release of the PHP 5.5 branch. There may be additional release if we discover important security issues that warrant it, otherwise this release will be the final one in the PHP 5.5 branch. If your PHP installation is based on PHP 5.5, it may be a good time to start making the plans for the upgrade to PHP 5.6 or PHP 7.0.

Source Code
PHP 5.5.38 (tar.bz2)
SHA256: 473c81ebb2e48ca468caee031762266651843d7227c18a824add9b07b9393e38
PHP 5.5.38 (tar.gz)
SHA256: 4f458c9b504269615715a62f182b7c2f89bb8284f484befc221b56a1571b506e
PHP 5.5.38 (tar.xz)
SHA256: cb527c44b48343c8557fe2446464ff1d4695155a95601083e5d1f175df95580f
Change Logs
bzip2
  • Fixed bug #72613 (Inadequate error handling in bzread()).
core
  • Fixed bug #70480 (php_url_parse_ex() buffer overflow read).
  • Fixed bug #72513 (Stack-based buffer overflow vulnerability in virtual_file_ex).
  • Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session Deserialization).
  • Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications). (CVE-2016-5385)
exif
  • Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
  • Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
gd
  • Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
  • Fixed bug #72519 (imagegif/output out-of-bounds access).
  • Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()). (CVE-2016-6207)
intl
  • Fixed bug #72533 (locale_accept_from_http out-of-bounds access).
odbc
  • Fixed bug #69975 defined columns)
snmp
  • Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).
xmlrpc
  • Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).
zip
  • Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).
To Top