PHP 4.4.7 Release Announcement - lots of security fixes

[TommyBALL]

PHP 4.4.7 Release Announcement

The PHP development team would like to announce the immediate availability of PHP 4.4.7. This release continues to improve the security and the stability of the 4.4 branch and all users are strongly encouraged to upgrade to it as soon as possible.
Security Enhancements and Fixes in PHP 4.4.7:

• Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)
• Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)
• Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)
• Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)
• Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)
• Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser).
• Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)
• XSS in phpinfo() (MOPB-8 by Stefan Esser)
• Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)
• Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser)
• Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)

While majority of the issues outlined above are local, few issues such as the XML-RPC overflows can be triggered remotely and therefor should be considered critical. If you use the XML-RPC extension consider upgrading as soon as possible.
Other improvements of PHP 4.4.7 include:

• About 10 bug fixes.

For a full list of changes in PHP 4.4.7, see the ChangeLog.

There we go.
http://www.php.net/downloads.php#v4

Regards
- Tommy

[---MAD---]

Our server manager says 4.4.6 is still more stable. Any idea why?

MAD

[jasonlitka]

Our server manager says 4.4.6 is still more stable. Any idea why?

MAD

Was he drinking when he said that? There's really no way he could have done any real testing at this point which means that he's probably just trying to avoid some work.

Seriously though, 4.4.7 includes patches to fix bugs from the Month of PHP Bugs, so it's probably a pretty good idea to install it if you're currently running 4.4.6.

[---MAD---]

Was he drinking when he said that? There's really no way he could have done any real testing at this point which means that he's probably just trying to avoid some work.

Seriously though, 4.4.7 includes patches to fix bugs from the Month of PHP Bugs, so it's probably a pretty good idea to install it if you're currently running 4.4.6.

No need to make up things if you are not 100% sure on what your saying...

[Floris]

Thank you for the heads up, I will go check some of my servers and see if we need to upgrade.

[jasonlitka]

No need to make up things if you are not 100% sure on what your saying...

While my comment was a bit sarcastic, I don't really think I'd go as far as saying I made it up. There really is no way that he could have made the determination as to whether or not it was more or less stable in 24 hours.

Given that there don't seem to be any feature enhancements and this is a bug-fix-only release of PHP, I still have to recommend that people upgrade if they're running 4.4.6.

[Mr-Mo3ath]

i have this proplem here
are welly fixed with mew relase
????????????

[Subah]

i have this proplem here
are welly fixed with mew relase
????????????

I hope i have the same problem