PHP 5.2.2 and PHP 4.4.7 Released!

CoolZero

Verified User
Joined
Jul 6, 2006
Messages
83
The PHP development team would like to announce the immediate
availability of PHP 5.2.2 and availability of PHP 4.4.7. These
releases are major stability and security enhancements of the 5.x and
4.4.x branches, and all users are strongly encouraged to upgrade to
it as soon as possible. Further details about the PHP 5.2.2 release
can be found in the release announcement for 5.2.2 http://www.php.net/releases/5_2_2.php.
Details about the PHP 4.4.7 release
can be found in the release announcement for 4.4.7 http://www.php.net/releases/4_4_7.php.

Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:

Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan
Fratric)
Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)
Fixed a bug in mb_parse_str() that can be used to activate
register_globals (MOPB-26 by Stefan Esser)
Fixed unallocated memory access/double free in in
array_user_key_compare() (MOPB-24 by Stefan Esser)
Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan
Esser)
Added missing open_basedir & safe_mode checks to zip:// and bzip://
wrappers. (MOPB-21 by Stefan Esser).
Limit nesting level of input variables with max_input_nesting_level
as fix for (MOPB-03 by Stefan Esser)
Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]
Bug.Center.Team)
Fixed a possible super-global overwrite inside
import_request_variables(). (by Stefano Di Paola, Stefan Esser)
Fixed a remotely trigger-able buffer overflow inside bundled
libxmlrpc library. (by Stanislav Malyshev)
Security Enhancements and Fixes in PHP 5.2.2 only:

Fixed a header injection via Subject and To parameters to the mail()
function (MOPB-34 by Stefan Esser)
Fixed wrong length calculation in unserialize S type (MOPB-29 by
Stefan Esser)
Fixed substr_compare and substr_count information leak (MOPB-14 by
Stefan Esser) (Stas, Ilia)
Fixed a remotely trigger-able buffer overflow inside
make_http_soap_request(). (by Ilia Alshanetsky)
Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia
Alshanetsky)
Security Enhancements and Fixes in PHP 4.4.7 only:

XSS in phpinfo() (MOPB-8 by Stefan Esser)
While majority of the issues outlined above are local, in some
circumstances given specific code paths they can be triggered
externally. Therefor, we strongly recommend that if you use code
utilizing the functions and extensions identified as having had
vulnerabilities in them, you consider upgrading your PHP.
 
From now they're in DirectAdmin servers. You can update them by running:
Code:
cd /usr/local/directadmin/customapache
./build update
./build php n
 
update went fine.

A question: all configurations that I did on php.ini are overwritten or they are still there?
 
A question: all configurations that I did on php.ini are overwritten or they are still there?

My Question was going to be "Will the updates overwrite my current php configurations?" :D

Since you already did yours, one way to chack would be to view your "phpinfo" file.

If you don't have one, create one and have a looksee...

Code:
<?php
phpinfo();
?>

Cheers..
 
The answer is no. If it detects a php.ini file in the location php is being installed to then it will leave it alone.

Grant
 
Code:
configure: error: utf8_mime2text() has new signature, but U8T_CANONICAL is missing. 
This should not happen. 
Check config.log for additional information.

This is what config.log says
Code:
configure:44337: checking for IMAP SSL support
configure:44715:19: /mail.h: No such file or directory
configure:44734: checking for utf8_mime2text signature
configure:44752: gcc -c -I  conftest.c 1>&5
gcc: no input files
configure: failed program was:
#line 44739 "configure"
#include "confdefs.h"

#include <stdio.h>
#include <c-client.h>

int main() {

        SIZEDTEXT *src, *dst;
        utf8_mime2text(src, dst);

; return 0; }
configure:44781: checking for U8T_CANONICAL
configure:44797: gcc -c -I  conftest.c 1>&5
gcc: no input files
configure: failed program was:
#line 44786 "configure"
#include "confdefs.h"

#include <c-client.h>

int main() {

         int i = U8T_CANONICAL;

; return 0; }

Running CentOS 4.something

Something went wrong i guess, howand where can i add U8T_CANONICAL ?
 
Last edited:
Same problem here, Debian...


Code:
configure: error: utf8_mime2text() has new signature, but U8T_CANONICAL is missing. 
This should not happen. 
Check config.log for additional information.

This is what config.log says
Code:
configure:44337: checking for IMAP SSL support
configure:44715:19: /mail.h: No such file or directory
configure:44734: checking for utf8_mime2text signature
configure:44752: gcc -c -I  conftest.c 1>&5
gcc: no input files
configure: failed program was:
#line 44739 "configure"
#include "confdefs.h"

#include <stdio.h>
#include <c-client.h>

int main() {

        SIZEDTEXT *src, *dst;
        utf8_mime2text(src, dst);

; return 0; }
configure:44781: checking for U8T_CANONICAL
configure:44797: gcc -c -I  conftest.c 1>&5
gcc: no input files
configure: failed program was:
#line 44786 "configure"
#include "confdefs.h"

#include <c-client.h>

int main() {

         int i = U8T_CANONICAL;

; return 0; }

Running CentOS 4.something

Something went wrong i guess, howand where can i add U8T_CANONICAL ?
 
Back
Top