PHP Release 5.6.27


    PHP 5.6.27 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.6.27. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.6.27 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.6.27 (tar.bz2)
    SHA256: 3b77d3a067b6e9cc7bb282d4d5b0e6eeb0623a828bb0479241e3b030446f2a3c
    PHP 5.6.27 (tar.gz)
    SHA256: 3e6cecec615907587a2b35fa8e7f915f038034dc57530734c2b94d381e664a1a
    PHP 5.6.27 (tar.xz)
    SHA256: 16eb544498339d1d855292826e2e547ab01a31600141094959073e5e10e93ab5
    Change Logs
    core
    • Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of zend_virtual_cwd.c).
    • Fixed bug #73058 (crypt broken when salt is 'too' long).
    • Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by password_verify).
    • Fixed bug #73189 (Memcpy negative size parameter php_resolve_path).
    • Fixed bug #73147 (Use After Free in unserialize()).
    bcmath
    • Fixed bug #73190 (memcpy negative parameter _bc_new_num_ex).
    dom
    • Fixed bug #73150 (missing NULL check in dom_document_save_html).
    ereg
    • Fixed bug #73284 (heap overflow in php_ereg_replace function).
    filter
    • Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and FILTER_FLAG_NO_PRIV_RANGE).
    • Fixed bug #67167 (Wrong return value from FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE).
    • Fixed bug #73054 (default option ignored when object passed to int filter).
    gd
    • Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
    • Fixed bug #50194 (imagettftext broken on transparent background w/o alphablending).
    • Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c).
    • Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
    • Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given).
    • Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries).
    • Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted files).
    • Fixed bug #73161 (imagecreatefromgd2() may leak memory).
    intl
    • Fixed bug #73218 (add mitigation for ICU int overflow).
    imap
    • Fixed bug #73208 (integer overflow in imap_8bit caused heap corruption).
    mbstring
    • Fixed bug #72994 (mbc_to_code() out of bounds read).
    • Fixed bug #66964 (mb_convert_variables() cannot detect recursion).
    • Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
    • Fixed bug #73082 (string length overflow in mb_encode_* function).
    pcre
    • Fixed bug #73174 (heap overflow in php_pcre_replace_impl).
    opcache
    • Fixed bug #72590 (Opcache restart with kill_all_lockers does not work). (Keyur)
    openssl
    • Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
    • Fixed bug #73275 (crash in openssl_encrypt function).
    • Fixed bug #73276 (crash in openssl_random_pseudo_bytes function).
    session
    • Fixed bug #68015 (Session does not report invalid uid for files save handler).
    • Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
    simplexml
    • Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
    spl
    • Fixed bug #73073 (CachingIterator null dereference when convert to string).
    standard
    • Fixed bug #73240 (Write out of bounds at number_format).
    • Fixed bug #73017 (memory corruption in wordwrap function).
    stream
    • Fixed bug #73069 (readfile() mangles files larger than 2G).
    zip
    • Fixed bug #70752 (Depacking with wrong password leaves 0 length files).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top