PHP Release 5.6.20


PHP 5.6.20 Release Announcement

The PHP development team announces the immediate availability of PHP 5.6.20. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

For source downloads of PHP 5.6.20 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

Source Code
PHP 5.6.20 (tar.bz2)
SHA256: 5ac7bf7caec7a79b18cf458e786fd1609ad2da771224b80bc15cc6f01b22bf1f
PHP 5.6.20 (tar.gz)
SHA256: 9a7ec6e1080ee93dcbe7df3e49ea1c3c3da5fc2258aff763f39ab3786baf8d56
PHP 5.6.20 (tar.xz)
SHA256: 2b87d40213361112af49157a435e0d4cdfd334c9b7c731c8b844932b1f444e7a
Change Logs
cli server
  • Fixed bug #69953 (Support MKCALENDAR request method).
core
  • Fixed bug #71596 (Segmentation fault on ZTS with date function (setlocale)).
curl
  • Fixed bug #71694 (Support constant CURLM_ADDED_ALREADY).
date
  • Fixed bug #71635 (DatePeriod::getEndDate segfault).
fileinfo
  • Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic file). (CVE-2015-8865)
mbstring
  • Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in mbfl_strcut). (CVE-2016-4073)
odbc
  • Fixed bug #47803, #69526 (Executing prepared statements is succesfull only for the first two statements).
  • Fixed bug #71860 (Invalid memory write in phar on filename with \0 in name). (CVE-2016-4072)
pdo_dblib
  • Fixed bug #54648 (PDO::MSSQL forces format of datetime fields).
phar
  • Fixed bug #71625 (Crash in php7.dll with bad phar filename).
  • Fixed bug #71504 (Parsing of tar file with duplicate filenames causes memory leak).
snmp
  • Fixed bug #71704 (php_snmp_error() Format String Vulnerability). (CVE-2016-4071)
standard
  • Fixed bug #71798 (Integer Overflow in php_raw_url_encode). (CVE-2016-4070)
To Top