PHP Release 5.6.7


    PHP 5.6.7 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.6.7. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.6 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.6.7 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.6.7 (tar.bz2)
    SHA256: 02954fb74c61a7879d48ebdcd4ecb78aa0056f4215ca9b096232de28eb8f17bc
    PHP 5.6.7 (tar.gz)
    SHA256: 11398540a582c876f5e070207231afde975eb49bb2eeae20b052e8ca325c0f47
    PHP 5.6.7 (tar.xz)
    SHA256: a85522dd2e6f80ee5637e537447ee54896c77a8fabe49d2310830d0e20952787
    Change Logs
    core
    • Fixed bug #69174 (leaks when unused inner class use traits precedence).
    • Fixed bug #69139 (Crash in gc_zval_possible_root on unserialize).
    • Fixed bug #69121 (Segfault in get_current_user when script owner is not in passwd with ZTS build).
    • Fixed bug #65593 (Segfault when calling ob_start from output buffering callback).
    • Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file not validated in memory.c).
    • Fixed bug #68166 (Exception with invalid character causes segv).
    • Fixed bug #69141 (Missing arguments in reflection info for some builtin functions).
    • Fixed bug #68976 (Use After Free Vulnerability in unserialize()). (CVE-2015-2787)
    • Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options).
    • Fixed bug #69207 (move_uploaded_file allows nulls in path). (CVE-2015-2348)
    cgi
    • Fixed bug #69015 (php-cgi's getopt does not see $argv).
    cli
    • Fixed bug #67741 (auto_prepend_file messes up __LINE__).
    curl
    • Fixed bug #69088 (PHP_MINIT_FUNCTION does not fully initialize cURL on Win32).
    • Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported by libcurl.
    ereg
    • Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (CVE-2015-2305)
    fpm
    • Fixed bug #68822 (request time is reset too early).
    odbc
    • Fixed bug #68964 (Allowed memory size exhausted with odbc_exec).
    opcache
    • Fixed bug #69159 (Opcache causes problem when passing a variable variable to a function).
    • Fixed bug #69125 (Array numeric string as key).
    • Fixed bug #69038 (switch(SOMECONSTANT) misbehaves).
    openssl
    • Fixed bug #68912 (Segmentation fault at openssl_spki_new).
    • Fixed bug #61285, #68329, #68046, #41631 (encrypted streams don't observe socket timeouts).
    • Fixed bug #68920 (use strict peer_fingerprint input checks)
    • Fixed bug #68879 (IP Address fields in subjectAltNames not used)
    • Fixed bug #68265 (SAN match fails with trailing DNS dot)
    • Fixed bug #67403 (Add signatureType to openssl_x509_parse)
    • Fixed bug (#69195 Inconsistent stream crypto values across versions)
    pgsql
    • Fixed bug #68638 (pg_update() fails to store infinite values).
    readline
    • Fixed bug #69054 (Null dereference in readline_(read|write)_history() without parameters).
    soap
    • Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()). (CVE-2015-4147, CVE-2015-4148)
    spl
    • Fixed bug #69108 ("Segmentation fault" when (de)serializing SplObjectStorage).
    • Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after calling getChildren()).
    zip
    • Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap boundary). (CVE-2015-2331)
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top