PHP Release 5.6.40

PHP 5.6.40 Release Announcement

The PHP development team announces the immediate availability of PHP 5.6.40. This is a security release. Several security bugs have been fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

For source downloads of PHP 5.6.40 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

Please note that according to the PHP version support timelines, PHP 5.6.40 is the last scheduled release of PHP 5.6 branch. There may be additional release if we discover important security issues that warrant it, otherwise this release will be the final one in the PHP 5.6 branch. If your PHP installation is based on PHP 5.6, it may be a good time to start making the plans for the upgrade to PHP 7.1, PHP 7.2 or PHP 7.3.

Source Code
PHP 5.6.40 (tar.bz2)
SHA256: ffd025d34623553ab2f7fd8fb21d0c9e6f9fa30dc565ca03a1d7b763023fba00
PHP 5.6.40 (tar.gz)
SHA256: 56fb9878d12fdd921f6a0897e919f4e980d930160e154cbde2cc6d9206a27cac
PHP 5.6.40 (tar.xz)
SHA256: 1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c
Change Logs
gd
  • Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to use-after-free).
  • Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap).
mbstring
  • Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token).
  • Fixed bug #77371 (heap buffer overflow in mb regex functions
  • compile_string_node).
  • Fixed bug #77381 (heap buffer overflow in multibyte match_at).
  • Fixed bug #77382 (heap buffer overflow due to incorrect length in expand_case_fold_string).
  • Fixed bug #77385 (buffer overflow in fetch_token).
  • Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode).
  • Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code).
phar
  • Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext).
xmlrpc
  • Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()).
  • Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code).
To Top