PHP Release 5.6.6


    PHP 5.6.6 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.6.6. This release fixes several bugs and addresses CVE-2015-0235 and CVE-2015-0273. All PHP 5.6 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.6.6 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.6.6 (tar.bz2)
    SHA256: 09625c9b65e0c8198dc76995a35f0feec0e13ea4489526e64a00954b12adbb4c
    PHP 5.6.6 (tar.gz)
    SHA256: 164fb27bab0a0ca4902bc67d5f5638e43466c88153aee3b54546d8ec682ec03b
    PHP 5.6.6 (tar.xz)
    SHA256: b963b2d45baeebeeb421c05ee60889e87971e3e27a4be873d265fee3250fde20
    Change Logs
    core
    • Removed support for multi-line headers, as the are deprecated by RFC 7230.
    • Fixed bug #67068 (getClosure returns somethings that's not a closure).
    • Fixed bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone). (CVE-2015-0273)
    • Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow).
    • Fixed Bug #67988 (htmlspecialchars() does not respect default_charset specified by ini_set)
    • Added NULL byte protection to exec, system and passthru.
    dba
    • Fixed bug #68711 (useless comparisons).
    enchant
    • Fixed bug #68552 (heap buffer overflow in enchant_broker_request_dict()). (CVE-2014-9705)
    fileinfo
    • Fixed bug #68827 (Double free with disabled ZMM).
    • Fixed bug #67647 (Bundled libmagic 5.17 does not detect quicktime files correctly).
    • Fixed bug #68731 (finfo_buffer doesn't extract the correct mime with some gifs).
    fpm
    • Fixed bug #66479 (Wrong response to FCGI_GET_VALUES).
    • Fixed bug #68571 (core dump when webserver close the socket).
    json
    • Fixed bug #50224 (json_encode() does not always encode a float as a float) by adding JSON_PRESERVE_ZERO_FRACTION.
    libxml
    • Fixed bug #64938 (libxml_disable_entity_loader setting is shared between threads).
    mysqli
    • Fixed bug #68114 (linker error on some OS X machines with fixed width decimal support)
    • Fixed bug #68657 (Reading 4 byte floats with Mysqli and libmysqlclient has rounding errors)
    opcache
    • Fixed bug with try blocks being removed when extended_info opcode generation is turned on.
    pdo_mysql
    • Fixed bug #68750 (PDOMysql with mysqlnd does not allow the usage of named pipes).
    phar
    • Fixed bug #68901 (use after free). (CVE-2015-2301)
    pgsql
    • Fixed Bug #65199 (pg_copy_from() modifies input array variable)
    session
    • Fixed bug #68941 (mod_files.sh is a bash-script)
    • Fixed Bug #66623 (no EINTR check on flock)
    • Fixed bug #68063 (Empty session IDs do still start sessions)
    sqlite3
    • Fixed bug #68260 (SQLite3Result::fetchArray declares wrong required_num_args).
    standard
    • Fixed bug #65272 (flock() out parameter not set correctly in windows).
    • Fixed bug #69033 (Request may get env. variables from previous requests if PHP works as FastCGI).
    streams
    • Fixed bug which caused call after final close on streams filter.
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top