News Archive - 2012

Here are the most important news items we have published in 2012 on PHP.net.


PHP 5.4.3 y PHP 5.3.13 liberados!

El equipo de desarrollo de PHP desea anunciar la disponibilidad inmediata de PHP 5.4.3 y PHP 5.3.13. Se recomienda a todos los usuarios a actualizar a PHP 5.4.3 y PHP 5.3.13.

Estas versiones complementan las correcciones para la vulnerabilidad de instalaciones basadas en CGI (CVE-2012-2311). Nota: mod_php y php-fpm no son vulnerables a este ataque.

PHP 5.4.3 soluciona una vulnerabilidad de desborde de buffer en apache_request_headers() (CVE-2012-2329). La serie PHP 5.3 no es vulnerable a este problema.

Para descargar el código fuente de 5.4.3 y PHP 5.3.13 ingrese a la sección de descargas, Binarios para Windows pueden encontrarse en windows.php.net/download/. Una lista de completa de cambios puede encontrarse en ChangeLog.


PHP 5.4.3 and PHP 5.3.13 Released!

The PHP development team would like to announce the immediate availability of PHP 5.4.3 and PHP 5.3.13. All users are encouraged to upgrade to PHP 5.4.3 or PHP 5.3.13

The releases complete a fix for a vulnerability in CGI-based setups (CVE-2012-2311). Note: mod_php and php-fpm are not vulnerable to this attack.

PHP 5.4.3 fixes a buffer overflow vulnerability in the apache_request_headers() (CVE-2012-2329). The PHP 5.3 series is not vulnerable to this issue.

For source downloads of PHP 5.4.3 and PHP 5.3.13 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes are recorded in the ChangeLog.


PHP 5.3.12, 5.4.2 y el fallo en CGI (CVE-2012-1823)

PHP 5.3.12/5.4.2 no soluciona todas las variaciones de los problemas de CGI descritos en CVE-2012-1823. Adicionalmente nos llama la atención que algunos sitios están usando un script CGI inseguro para correr PHP. Estos scripts usan $* en vez de "[email protected]" para pasarle parámetros a php-cgi causando un variado número de fallos. Repetimos, la gente usando mod_php or php-fpm no están afectados.

Una forma de tratar estos problemas de CGI es rechazar la petición si el query string contiene un '-' y no un '='. Esto se puede hacer usando mod_rewrite de Apache de esta forma:

RewriteCond %{QUERY_STRING} ^[^=]*$
RewriteCond %{QUERY_STRING} %2d|\- [NC]
RewriteRule .? - [F,L]

Tengase en cuenta que esto bloqueará de igual forma peticiones seguras como ?top-40 so así que si tienes peticiones como esa, se debe ajustar las expresiones regulares de acuerdo a ello.

Otro gurpo de versiones está planeado para el 8 de Mayo. Estas solucionan un problema del CGI y otro relacionado con apache_request_header (solo 5.4).

Pedimos discuplas por el inconveniente creado con estos lanzamientos y la falta de comunicación sobre ello.


PHP 5.3.12 and 5.4.2 and the CGI flaw (CVE-2012-1823)

PHP 5.3.12/5.4.2 do not fix all variations of the CGI issues described in CVE-2012-1823. It has also come to our attention that some sites use an insecure cgiwrapper script to run PHP. These scripts will use $* instead of "[email protected]" to pass parameters to php-cgi which causes a number of issues. Again, people using mod_php or php-fpm are not affected.

One way to address these CGI issues is to reject the request if the query string contains a '-' and no '='. It can be done using Apache's mod_rewrite like this:

    RewriteCond %{QUERY_STRING} ^[^=]*$
    RewriteCond %{QUERY_STRING} %2d|\- [NC]
    RewriteRule .? - [F,L]
    
Note that this will block otherwise safe requests like ?top-40 so if you have query parameters that look like that, adjust your regex accordingly.

Another set of releases are planned for Tuesday, May, 8th. These releases will fix the CGI flaw and another CGI-related issue in apache_request_header (5.4 only).

We apologize for the inconvenience created with these releases and the (lack of) communication around them.


PHP 5.3.12 y PHP 5.4.2 liberados!

Existe una vulnerabilidad en ciertas instalaciones badadas en CGI (Apache+mod_php y nginx+php-fpm no están afectadas) que no habia sido identificada en los últimos 8 años. Sección 7 de la especificación CGI afirma:

Algunos sistemas soportan un método para suplir un array de cadenas de carácteres a el script CGI. Esto solo es usado en caso de una búsqueda 'indexada', Esto se indentica con una petición HTTP "GET" ó "HEAD" con una URL de búsqueda que no tenga carácteres "=" codificados.

Asi que, las peticiones que no tengan un "=" en la cadena de consulta son tratados de manera diferente para esas implementaciones de CGI. Para PHP esto significa que una petición que contenga ?-s podría volcar el código de PHP de la pagina, aunque una petición con ?-s&=1 estaría bien.

Un gran número de sitios con PHP corren tanto con el modulo de Apache con mod_php como con php-fpm bajo nginx. Ninguno de esas instalaciones son vulnerables a esto. A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this.

Si estás usando Apache con mod_cgi para PHP podrías ser vulnerable. Para saber si lo es, solamente agrega un ?-s al final de cualquiera de sus URLs. Si ve un código fuente, entonces es vulnerable. Si su sitio se visualiza normalmente entonces no.

Para solucionar esto actualiza a PHP 5.3.12 o PHP 5.4.2.

Reconocemos que CGI es un metodo desactualizado para correr PHP y que podría no ser posible actualizar a una versión más reciente de PHP. Una alternativa es configurar su servidor web para no permitir este tipo de peticiones con empezando con un "-" y además sin un "=". Agregar una regla como esta no debería romper ningún sitio. Usando mod_rewrite de Apache sería algo así:

RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC]
RewriteRule ^(.*) $1? [L]

Si tiene sus propias reglas asegurese de codificar ?%2ds.

Para terminar una mala semana, tenemos un bug en nuestro sistema de errores haciendo que la bandera de privacidad no funcionara haciendo público este inconveniente sin que tuveriamos tiempo de probar una solución al nivel que queriamos. Por favor reporta cualquier problema en bugs.php.net.

Binarios para Windows pueden encontrarse en windows.php.net/download/. Una lista de completa de cambios puede encontrarse en ChangeLog.


PHP 5.3.12 and PHP 5.4.2 Released!

There is a vulnerability in certain CGI-based setups (Apache+mod_php and nginx+php-fpm are not affected) that has gone unnoticed for at least 8 years. Section 7 of the CGI spec states:

Some systems support a method for supplying a [sic] array of strings to the CGI script. This is only used in the case of an `indexed' query. This is identified by a "GET" or "HEAD" HTTP request with a URL search string not containing any unencoded "=" characters.

So, requests that do not have a "=" in the query string are treated differently from those who do in some CGI implementations. For PHP this means that a request containing ?-s may dump the PHP source code for the page, but a request that has ?-s&=1 is fine.

A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. Straight shebang-style CGI also does not appear to be vulnerable.

If you are using Apache mod_cgi to run PHP you may be vulnerable. To see if you are, just add ?-s to the end of any of your URLs. If you see your source code, you are vulnerable. If your site renders normally, you are not.

To fix this, update to PHP 5.3.12 or PHP 5.4.2.

We recognize that since CGI is a rather outdated way to run PHP, it may not be feasible to upgrade these sites to a modern version of PHP. An alternative is to configure your web server to not let these types of requests with query strings starting with a "-" and not containing a "=" through. Adding a rule like this should not break any sites. For Apache using mod_rewrite it would look like this:

         RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC]
         RewriteRule ^(.*) $1? [L]
     

If you are writing your own rule, be sure to take the urlencoded ?%2ds version into account.

Making a bad week worse, we had a bug in our bug system that toggled the private flag of a bug report to public on a comment to the bug report causing this issue to go public before we had time to test solutions to the level we would like. Please report any issues via bugs.php.net.

For source downloads of PHP 5.3.12 and PHP 5.4.2 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. A ChangeLog exists.


DevConf 2012

DevConf 2012 in Moscow, Russia on Jun 9 - Jun 10

DevConf is the ultimate meeting place for russian-speaking web-developers, combining several language-specific conferences under one roof.

This year DevConf will include the following sections:

  • DevConf::PHP();
  • DevConf::Perl();
  • DevConf::RoR();
  • DevConf::Python();
  • DevConf::Javascript();

Each section will feature several talks from the active contributors/authors of the language. Among the invited speakers are Derick Rethans (XDebug creator), David Soria Parra (active PHP contributor), Andrey Aksyonov (author of Sphinx), Alexander Makarov (one of the main contributors to Yii), Sergey Petrunya (of MariaDB fame), Ilya Alekseev (OpenStack Nova contributor) and many others, see more details on the official website.


PHP 5.3.11 And PHP 5.4.1 Released!

The PHP development team announces the immediate availability of PHP 5.3.11 and PHP 5.4.1. These releases focuses on improving the stability of the current PHP branches with over 60 bug fixes, some of which are security related.

Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:

  • Fixed bug #54374 (Insufficient validating of upload name leading to corrupted $_FILES indices). (CVE-2012-1172).
  • Add open_basedir checks to readline_write_history and readline_read_history.

Security Enhancement affecting PHP 5.3.11 only:

  • Fixed bug #61043 (Regression in magic_quotes_gpc fix for CVE-2012-0831).

Key enhancements in these releases include:

  • Added debug info handler to DOM objects.
  • Fixed bug #61172 (Add Apache 2.4 support).

For a full list of changes in PHP 5.3.11 and PHP 5.4.1, see the ChangeLog. For source downloads please visit our downloads page, Windows binaries can be found on windows.php.net/download/.

All users of PHP are strongly encouraged to upgrade to PHP 5.3.11 or PHP 5.4.1.


PHP 5.4.1RC2 Released for Testing

The PHP development team would like to announce the 2nd release candidate of PHP 5.4.1. Windows binaries can be downloaded from the Windows QA site.

THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION!

This is the 2nd release candidate. The release candidate phase is intended as a period of bug fixing prior to the stable release. The release candidate fixes a critical issue when using the internal classes in multiple threads.

A complete list of changes since the last release candidate can be found in the NEWS file.

Please help us to identify bugs in order to ensure that the release is solid and all things behave as expected by taking the time to test this release candidate against your code base and reporting any problems that you encounter to the QA mailing list and/or the PHP bug tracker.

PHP 5.4.1 final will be released on April 26.


PHP migrates to Git

The migration of the PHP source code from Subversion to Git is complete. You can clone or fork the source from our GitHub mirror, and we also now support pull requests made via GitHub. The source is also available via git.php.net, and full instructions on cloning the php-src tree can be found at php.net/git.

One immediate benefit is that future PHP release tags will be signed by the PHP development team. We will be releasing GPG keys for verification purposes in the next few days.

More information on the migration and the new workflow can be found at the Moving to Git FAQ on the PHP Wiki.

Please note that the PHP manual, including translations, continues to be hosted in Subversion for the time being and will be migrated to Git at a later date.

Many thanks to David Soria Parra for his hard work on making the conversion to Git a reality, and to Alexander Moskaliov, Florian Anderiasch and Johannes Schlüter for their work on the scripts required to support the conversion. Let the forking begin!


PHP 5.4.0 released!

The PHP development team is proud to announce the immediate availability of PHP 5.4.0. This release is a major leap forward in the 5.x series, which includes a large number of new features and bug fixes.

Some of the key new features include: traits, a shortened array syntax, a built-in webserver for testing purposes and more. PHP 5.4.0 significantly improves performance, memory footprint and fixes over 100 bugs.

For users upgrading from PHP 5.3 there is a migration guide available here, detailing the changes between those releases and PHP 5.4.0.

Further details about the PHP 5.4.0 release can be found in the release announcement, and the full list of changes are available in the ChangeLog.

Please note that it may take a while until the release is available on all mirrors.


PHP 5.4.0 RC8 released

The PHP development team would like to announce the 8th release candidate of PHP 5.4. PHP 5.4 includes new language features and removes several legacy (deprecated) behaviours. Windows binaries can be downloaded from the Windows QA site.

THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION! .

This is the 8th release candidate. The release candidate phase is intended as a period of bug fixing prior to the stable release. No new features should be included before the final version of PHP 5.4.0.

The 7th and 8th release candidates focus on fixing critical bugs and security vulnerabilities, including:

  • A buffer overflow in htmlspecialchars() and htmlentities() (bug #60965).
  • Improving the max_input_vars configuration directive to check nested variables.

A complete list of changes since the last release candidate can be found in the NEWS file.

We've received a lot of feedback that has helped to improve the upcoming release of PHP 5.4.0. Please continue to help us to identify bugs in order to ensure that the release is solid and all things behave as expected by taking the time to test this release candidate against your code base and reporting any problems that you encounter to the QA mailing list and/or the PHP bug tracker.

The next release candidate will be released on March 1.


Northeast PHP conference - Call for Papers!

Please note: This call for papers closes on 12 April, 2012.

Wanting to share your experiences with a larger PHP community? Please submit your name and topic ideas (even if you are only suggesting topics and not wishing to actually present them) - each topic requires a separate submission, submit as many as you like:

http://speakers.northeastphp.org

We hope to have topics and hands-on workshops in four tracks:

  • Core PHP topics (Intermediate to Advanced levels)
  • Web development related topics
  • Training track (workshop style)
  • UX related topics

This event is co-organized by 3 User Groups in the Northeast of North America, namely: Atlantic Canada, Vermont and Area, and Boston.


PHP 5.3.10 Released!

The PHP development team would like to announce the immediate availability of PHP 5.3.10. This release delivers a critical security fix.

Security Fixes in PHP 5.3.10:

  • Fixed arbitrary remote code execution vulnerability reported by Stefan Esser, CVE-2012-0830.

All users are strongly encouraged to upgrade to PHP 5.3.10.

For source downloads please visit our downloads page, Windows binaries can be found on windows.php.net/download/.


PHP 5.4.0 RC6 released

The PHP development team announces the 6th release candidate of PHP 5.4. PHP 5.4 includes new language features and removes several legacy (deprecated) behaviours. Windows binaries can be downloaded from the Windows QA site.

THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION!.

This is the 6th release candidate. The release candidate phase is intended as a period of bug fixing prior to the stable release. No new features should be included before the final version of PHP 5.4.0.

The 6th release candidate focused on improving traits. Please test them carefully and help us to identify bugs in order to ensure that the release is solid and all things behave as expected. Please take the time to test this release candidate against your code base and report any problems that you encounter to the QA mailing list and/or the PHP bug tracker.

A complete list of changes since the last release candidate can be found at NEWS

The next candidate will be released on Feb 2.


PHP 5.3.9 Released!

The PHP development team would like to announce the immediate availability of PHP 5.3.9. This release focuses on improving the stability of the PHP 5.3.x branch with over 90 bug fixes, some of which are security related.

Security Enhancements and Fixes in PHP 5.3.9:

  • Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885)
  • Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566)

Key enhancements in PHP 5.3.9 include:

  • Fixed bug #55475 (is_a() triggers autoloader, new optional 3rd argument to is_a and is_subclass_of).
  • Fixed bug #55609 (mysqlnd cannot be built shared)
  • Many changes to the FPM SAPI module

For a full list of changes in PHP 5.3.9, see the ChangeLog. For source downloads please visit our downloads page, Windows binaries can be found on windows.php.net/download/.

All users are strongly encouraged to upgrade to PHP 5.3.9.


PHP 5.4.0 RC5 released

The PHP development team announces the 5th release candidate of PHP 5.4. PHP 5.4 includes new language features and removes several legacy (deprecated) behaviours. Windows binaries can be downloaded from the Windows QA site.

THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION!.

This is the 5th release candidate. The release candidate phase is intended as a period of bug fixing prior to the stable release. No new features should be included before the final version of PHP 5.4.0.

We got a lot of feedback that helped us to improve the upcoming PHP version. Please continue to help us to identify bugs in order to ensure that the release is solid and all things behave as expected. Please take the time to test this release candidate against your code base and report any problems that you encounter to the QA mailing list and/or the PHP bug tracker.

A complete list of changes since the last release candidate can be found at NEWS

The next and probably last release candidate will be released in 14 days.



Cache file /data/nikos/phalconphp.com/php-site/public/../app/cache/php2012 could not be written