PHP Release 5.6.13


    PHP 5.6.13 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.6.13. 11 security-related issues were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.6.13 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.6.13 (tar.bz2)
    SHA256: 6358837c9cbab41b91ede59dbf0670ae0fb925a1369ecbc1a44a27212420f893
    PHP 5.6.13 (tar.gz)
    SHA256: 92acc6c067f5e015a6881b4119eafec10eca11722e810f2c2083f72e17119bcf
    PHP 5.6.13 (tar.xz)
    SHA256: c1f0837df20cd3bed149033924770deca3e7e2d18e2e7e81395096576f153fdc
    Change Logs
    core
    • Fixed bug #69900 (Too long timeout on pipes).
    • Fixed bug #69487 (SAPI may truncate POST data).
    • Fixed bug #70198 (Checking liveness does not work as expected).
    • Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (CVE-2015-6834)
    • Fixed bug #70219 (Use after free vulnerability in session deserializer). (CVE-2015-6835)
    cli server
    • Fixed bug #66606 (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE).
    • Fixed bug #70264 (CLI server directory traversal).
    date
    • Fixed bug #70266 (DateInterval::__construct.interval_spec is not supposed to be optional).
    • Fixed bug #70277 (new DateTimeZone($foo) is ignoring text after null byte).
    exif
    • Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).
    gmp
    • Fixed bug #70284 (Use after free vulnerability in unserialize() with GMP).
    hash
    • Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).
    mcrypt
    • Fixed bug #69833 (mcrypt fd caching not working).
    opcache
    • Fixed bug #70237 (Empty while and do-while segmentation fault with opcode on CLI enabled).
    pcre
    • Fixed bug #70232 (Incorrect bump-along behavior with \K and empty string match).
    • Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).
    soap
    • Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE). (CVE-2015-6836)
    spl
    • Fixed bug #70290 (Null pointer deref (segfault) in spl_autoload via ob_start).
    • Fixed bug #70303 (Incorrect constructor reflection for ArrayObject).
    • Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6834)
    • Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6834)
    standard
    • Fixed bug #70052 (getimagesize() fails for very large and very small WBMP).
    • Fixed bug #70157 (parse_ini_string() segmentation fault with INI_SCANNER_TYPED).
    xslt
    • Fixed bug #69782 (NULL pointer dereference). (CVE-2015-6837, CVE-2015-6838)
    zip
    • Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories). (CVE-2014-9767)
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top