PHP Release 5.6.24


    PHP 5.6.24 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.6.24. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.6.24 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.6.24 (tar.bz2)
    SHA256: bf23617ec3ed0a125ec8bde2b7bca9d3804b2ff4df8de192890c84dc9fac38c6
    PHP 5.6.24 (tar.gz)
    SHA256: 5f8b2e4e00360fee6eb1b89447266ae45993265955bd1ea9866270d75cdb6ec1
    PHP 5.6.24 (tar.xz)
    SHA256: ed7c38c6dac539ade62e08118258f4dac0c49beca04d8603bee4e0ea6ca8250b
    Change Logs
    core
    • Fixed bug #71936 (Segmentation fault destroying HTTP_RAW_POST_DATA).
    • Fixed bug #72496 (Cannot declare public method with signature incompatible with parent private method).
    • Fixed bug #72138 (Integer Overflow in Length of String-typed ZVAL).
    • Fixed bug #72513 (Stack-based buffer overflow vulnerability in virtual_file_ex).
    • Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session Deserialization).
    • Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications). (CVE-2016-5385)
    bz2
    • Fixed bug #72447 (Type Confusion in php_bz2_filter_create()). .
    • Fixed bug #72613 (Inadequate error handling in bzread()).
    date
    • Fixed bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing).
    exif
    • Fixed bug #50845 (exif_read_data() returns corrupted exif headers).
    • Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
    • Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
    gd
    • Fixed bug #43475 (Thick styled lines have scrambled patterns).
    • Fixed bug #53640 (XBM images require width to be multiple of 8).
    • Fixed bug #64641 (imagefilledpolygon doesn't draw horizontal line).
    • Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
    • Fixed bug #72519 (imagegif/output out-of-bounds access).
    • Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()). (CVE-2016-6207)
    intl
    • Fixed bug #72533 (locale_accept_from_http out-of-bounds access).
    openssl
    • Fixed bug #71915 (openssl_random_pseudo_bytes is not fork-safe).
    • Fixed bug #72336 (openssl_pkey_new does not fail for invalid DSA params).
    snmp
    • Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).
    spl
    • Fixed bug #55701 (GlobIterator throws LogicException).
    sqlite3
    • Fixed bug #70628 (Clearing bindings on an SQLite3 statement doesn't work).
    streams
    • Fixed bug #72439 (Stream socket with remote address leads to a segmentation fault).
    xmlrpc
    • Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).
    zip
    • Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top