Announcement

Collapse
No announcement yet.

PHP 4.4.7 Release Announcement - lots of security fixes

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • PHP 4.4.7 Release Announcement - lots of security fixes

    PHP 4.4.7 Release Announcement

    The PHP development team would like to announce the immediate availability of PHP 4.4.7. This release continues to improve the security and the stability of the 4.4 branch and all users are strongly encouraged to upgrade to it as soon as possible.
    Security Enhancements and Fixes in PHP 4.4.7:
    • Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)
    • Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)
    • Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)
    • Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)
    • Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)
    • Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser).
    • Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)
    • XSS in phpinfo() (MOPB-8 by Stefan Esser)
    • Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)
    • Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser)
    • Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)
    While majority of the issues outlined above are local, few issues such as the XML-RPC overflows can be triggered remotely and therefor should be considered critical. If you use the XML-RPC extension consider upgrading as soon as possible.
    Other improvements of PHP 4.4.7 include:
    • About 10 bug fixes.
    For a full list of changes in PHP 4.4.7, see the ChangeLog.
    There we go.
    http://www.php.net/downloads.php#v4

    Regards
    - Tommy
    MCP / MCSA / MCSE / MCT
    A few eggs short of a complete easter basket

    vB 4.0.5+ CMS (No hacks), Windows Server 2008 R2 Ent, IIS 7.5, PHP 5.3+ (FastCGI), WinCache, Memcached, MySQL 5.1.45

  • #2
    Our server manager says 4.4.6 is still more stable. Any idea why?

    MAD

    Comment


    • #3
      Originally posted by ---MAD--- View Post
      Our server manager says 4.4.6 is still more stable. Any idea why?

      MAD
      Was he drinking when he said that? There's really no way he could have done any real testing at this point which means that he's probably just trying to avoid some work.

      Seriously though, 4.4.7 includes patches to fix bugs from the Month of PHP Bugs, so it's probably a pretty good idea to install it if you're currently running 4.4.6.
      Jason Litka - Utter Ramblings

      Comment


      • #4
        Originally posted by jason|xoxide View Post
        Was he drinking when he said that? There's really no way he could have done any real testing at this point which means that he's probably just trying to avoid some work.

        Seriously though, 4.4.7 includes patches to fix bugs from the Month of PHP Bugs, so it's probably a pretty good idea to install it if you're currently running 4.4.6.
        No need to make up things if you are not 100% sure on what your saying...

        Comment


        • #5
          Thank you for the heads up, I will go check some of my servers and see if we need to upgrade.

          Comment


          • #6
            Originally posted by ---MAD--- View Post
            No need to make up things if you are not 100% sure on what your saying...
            While my comment was a bit sarcastic, I don't really think I'd go as far as saying I made it up. There really is no way that he could have made the determination as to whether or not it was more or less stable in 24 hours.

            Given that there don't seem to be any feature enhancements and this is a bug-fix-only release of PHP, I still have to recommend that people upgrade if they're running 4.4.6.
            Jason Litka - Utter Ramblings

            Comment


            • #7
              i have this proplem here
              are welly fixed with mew relase
              ????????????
              I request you to enter and give me your views and arise on the following topics:-

              Comment


              • #8
                Originally posted by love4allah.com View Post
                i have this proplem here
                are welly fixed with mew relase
                ????????????
                I hope i have the same problem

                Comment

                widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                Working...
                X