PHP Release 5.6.23


    PHP 5.6.23 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.6.23. Several bugs were fixed in this release, including security-related ones. All PHP 5.6 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.6.23 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.6.23 (tar.bz2)
    SHA256: facd280896d277e6f7084b60839e693d4db68318bfc92085d3dc0251fd3558c7
    PHP 5.6.23 (tar.gz)
    SHA256: 5f2274a13970887e8c81500c2afe292d51c3524d1a06554b0a87c74ce0a24ffe
    PHP 5.6.23 (tar.xz)
    SHA256: 39141e9a617af172aedbbacee7a63eb15502850f7cea20d759a9cffa7cfb0a1a
    Change Logs
    core
    • Fixed bug #72268 (Integer Overflow in nl2br()).
    • Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).
    • Fixed bug #72400 (Integer Overflow in addcslashes/addslashes).
    • Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL).
    date
    • Fixed bug #63740 (strtotime seems to use both sunday and monday as start of week).
    gd
    • Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
    • Fixed bug #72298 (pass2_no_dither out-of-bounds access).
    • Fixed bug #72337 (invalid dimensions can lead to crash).
    • Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)
    • Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert).
    • Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)
    intl
    • Fixed bug #70484 (selectordinal doesn't work with named parameters).
    mbstring
    • Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)
    mcrypt
    • Fixed bug #72455 (Heap Overflow due to integer overflows). (CVE-2016-5769)
    openssl
    • Fixed bug #72140 (segfault after calling ERR_free_strings()).
    phar
    • Fixed bug #72321 (invalid free in phar_extract_file()).
    spl
    • Fixed bug #72262 (int/size_t confusion in SplFileObject::fread). (CVE-2016-5770)
    • Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5771)
    wddx
    • Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)
    zip
    • Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top