Version 5.3.3 22-July-2010 Upgraded bundled sqlite to version 3.6.23.1. (Ilia) Upgraded bundled PCRE to version 8.02. (Ilia) Added support for JSON_NUMERIC_CHECK option in json_encode() that converts numeric strings to integers. (Ilia) Added stream_set_read_buffer, allows to set the buffer for read operation. (Pierre) Added stream filter support to mcrypt extension (ported from mcrypt_filter). (Stas) Added full_special_chars filter to ext/filter. (Rasmus) Added backlog socket context option for stream_socket_server(). (Mike) Added fifth parameter to openssl_encrypt()/openssl_decrypt() (string $iv) to use non-NULL IV. Made implicit use of NULL IV a warning. (Sara) Added openssl_cipher_iv_length(). (Sara) Added FastCGI Process Manager (FPM) SAPI. (Tony) Added recent Windows versions to php_uname and fix undefined windows version support. (Pierre) Added Berkeley DB 5 support to the DBA extension. (Johannes, Chris Jones) Added support for copy to/from array/file for pdo_pgsql extension. (Denis Gasparin, Ilia) Added inTransaction() method to PDO, with specialized support for Postgres. (Ilia, Denis Gasparin) Changed namespaced classes so that the ctor can only be named __construct now. (Stas) Reset error state in PDO::beginTransaction() reset error state. (Ilia) Implemented FR #51295 (SQLite3::busyTimeout not existing). (Mark) Implemented FR #35638 (Adding udate to imap_fetch_overview results). (Charles_Duffy at dell dot com ) Rewrote var_export() to use smart_str rather than output buffering, prevents data disclosure if a fatal error occurs (CVE-2010-2531). (Scott) Fixed possible buffer overflows in mysqlnd_list_fields, mysqlnd_change_user. (Andrey) Fixed possible buffer overflows when handling error packets in mysqlnd. Reported by Stefan Esser. (Andrey) Fixed very rare memory leak in mysqlnd, when binding thousands of columns. (Andrey) Fixed a crash when calling an inexistent method of a class that inherits PDOStatement if instantiated directly instead of doing by the PDO methods. (Felipe) Fixed memory leak on error in mcrypt_create_iv on Windows. (Pierre) Fixed a possible crash because of recursive GC invocation. (Dmitry) Fixed a possible resource destruction issues in shm_put_var(). Reported by Stefan Esser. (Dmitry) Fixed a possible information leak because of interruption of XOR operator. Reported by Stefan Esser. (Dmitry) Fixed a possible memory corruption because of unexpected call-time pass by refernce and following memory clobbering through callbacks. Reported by Stefan Esser. (Dmitry) Fixed a possible memory corruption in ArrayObject::uasort(). Reported by Stefan Esser. (Dmitry) Fixed a possible memory corruption in parse_str(). Reported by Stefan Esser. (Dmitry) Fixed a possible memory corruption in pack(). Reported by Stefan Esser. (Dmitry) Fixed a possible memory corruption in substr_replace(). Reported by Stefan Esser. (Dmitry) Fixed a possible memory corruption in addcslashes(). Reported by Stefan Esser. (Dmitry) Fixed a possible stack exhaustion inside fnmatch(). Reported by Stefan Esser. (Ilia) Fixed a possible dechunking filter buffer overflow. Reported by Stefan Esser. (Pierre) Fixed a possible arbitrary memory access inside sqlite extension. Reported by Mateusz Kocielski. (Ilia) Fixed string format validation inside phar extension. Reported by Stefan Esser. (Ilia) Fixed handling of session variable serialization on certain prefix characters. Reported by Stefan Esser. (Ilia) Fixed a NULL pointer dereference when processing invalid XML-RPC requests (Fixes CVE-2010-0397, bug #51288). (Raphael Geissert) Fixed 64-bit integer overflow in mhash_keygen_s2k(). (Clément LECIGNE, Stas) Fixed SplObjectStorage unserialization problems (CVE-2010-2225). (Stas) Fixed the mail.log ini setting when no filename was given. (Johannes) Fixed bug #52317 (Segmentation fault when using mail() on a rhel 4.x (only 64 bit)). (Adam) Fixed bug #52262 (json_decode() shows no errors on invalid UTF-8). (Scott) Fixed bug #52240 (hash_copy() does not copy the HMAC key, causes wrong results and PHP crashes). (Felipe) Fixed bug #52238 (Crash when an Exception occured in iterator_to_array). (Johannes) Fixed bug #52193 (converting closure to array yields empty array). (Felipe) Fixed bug #52183 (Reflectionfunction reports invalid number of arguments for function aliases). (Felipe) Fixed bug #52162 (custom request header variables with numbers are removed). (Sriram Natarajan) Fixed bug #52160 (Invalid E_STRICT redefined constructor error). (Felipe) Fixed bug #52138 (Constants are parsed into the ini file for section names). (Felipe) Fixed bug #52115 (mysqli_result::fetch_all returns null, not an empty array). (Andrey) Fixed bug #52101 (dns_get_record() garbage in 'ipv6' field on Windows). (Pierre) Fixed bug #52082 (character_set_client & character_set_connection reset after mysqli_change_user()). (Andrey) Fixed bug #52043 (GD doesn't recognize latest libJPEG versions). (php at group dot apple dot com, Pierre) Fixed bug #52041 (Memory leak when writing on uninitialized variable returned from function). (Dmitry) Fixed bug #52060 (Memory leak when passing a closure to method_exists()). (Felipe) Fixed bug #52057 (ReflectionClass fails on Closure class). (Felipe) Fixed bug #52051 (handling of case sensitivity of old-style constructors changed in 5.3+). (Felipe) Fixed bug #52037 (Concurrent builds fail in install-programs). (seanius at debian dot org, Kalle) Fixed bug #52019 (make lcov doesn't support TESTS variable anymore). (Patrick) Fixed bug #52010 (open_basedir restrictions mismatch on vacuum command). (Ilia) Fixed bug #52001 (Memory allocation problems after using variable variables). (Dmitry) Fixed bug #51991 (spl_autoload and *nix support with namespace). (Felipe) Fixed bug #51943 (AIX: Several files are out of ANSI spec). (Kalle, coreystup at gmail dot com) Fixed bug #51911 (ReflectionParameter::getDefaultValue() memory leaks with constant array). (Felipe) Fixed bug #51905 (ReflectionParameter fails if default value is an array with an access to self::). (Felipe) Fixed bug #51899 (Parse error in parse_ini_file() function when empy value followed by no newline). (Felipe) Fixed bug #51844 (checkdnsrr does not support types other than MX). (Pierre) Fixed bug #51827 (Bad warning when register_shutdown_function called with wrong num of parameters). (Felipe) Fixed bug #51822 (Segfault with strange __destruct() for static class variables). (Dmitry) Fixed bug #51791 (constant() aborts execution when fail to check undefined constant). (Felipe) Fixed bug #51732 (Fileinfo __construct or open does not work with NULL). (Pierre) Fixed bug #51725 (xmlrpc_get_type() returns true on invalid dates). (Mike) Fixed bug #51723 (Content-length header is limited to 32bit integer with Apache2 on Windows). (Pierre) Fixed bug #51721 (mark DOMNodeList and DOMNamedNodeMap as Traversable). (David Zuelke) Fixed bug #51712 (Test mysql_mysqlnd_read_timeout_long must fail on MySQL4). (Andrey) Fixed bug #51697 (Unsafe operations in free_storage of SPL iterators, causes crash during shutdown). (Etienne) Fixed bug #51690 (Phar::setStub looks for case-sensitive __HALT_COMPILER()). (Ilia) Fixed bug #51688 (ini per dir crashes when invalid document root are given). (Pierre) Fixed bug #51671 (imagefill does not work correctly for small images). (Pierre) Fixed bug #51670 (getColumnMeta causes segfault when re-executing query after calling nextRowset). (Pierrick) Fixed bug #51647 Certificate file without private key (pk in another file) doesn't work. (Andrey) Fixed bug #51629 (CURLOPT_FOLLOWLOCATION error message is misleading). (Pierre) Fixed bug #51627 (script path not correctly evaluated). (russell dot tempero at rightnow dot com) Fixed bug #51624 (Crash when calling mysqli_options()). (Felipe) Fixed bug #51615 (PHP crash with wrong HTML in SimpleXML). (Felipe) Fixed bug #51609 (pg_copy_to: Invalid results when using fourth parameter). (Felipe) Fixed bug #51608 (pg_copy_to: WARNING: nonstandard use of \\ in a string literal). (cbandy at jbandy dot com) Fixed bug #51607 (pg_copy_from does not allow schema in the tablename argument). (cbandy at jbandy dot com) Fixed bug #51605 (Mysqli - zombie links). (Andrey) Fixed bug #51604 (newline in end of header is shown in start of message). (Daniel Egeberg) Fixed bug #51590 (JSON_ERROR_UTF8 is undefined). (Felipe) Fixed bug #51583 (Bus error due to wrong alignment in mysqlnd). (Rainer Jung) Fixed bug #51582 (Don't assume UINT64_C it's ever available). (reidrac at usebox dot net, Pierre) Fixed bug #51577 (Uninitialized memory reference with oci_bind_array_by_name) (Oracle Corp.) Fixed bug #51562 (query timeout in mssql can not be changed per query). (ejsmont dot artur at gmail dot com) Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues). (Dmitry) Fixed bug #51445 (var_dump() invalid/slow *RECURSION* detection). (Felipe) Fixed bug #51435 (Missing ifdefs / logic bug in crypt code cause compile errors). (Felipe) Fixed bug #51424 (crypt() function hangs after 3rd call). (Pierre, Sriram) Fixed bug #51394 (Error line reported incorrectly if error handler throws an exception). (Stas) Fixed bug #51393 (DateTime::createFromFormat() fails if format string contains timezone). (Adam) Fixed bug #51347 (mysqli_close / connection memory leak). (Andrey, Johannes) Fixed bug #51338 (URL-Rewriter is still enabled if use_only_cookies is on). (Ilia, j dot jeising at gmail dot com) Fixed bug #51291 (oci_error doesn't report last error when called two times) (Oracle Corp.) Fixed bug #51276 (php_load_extension() is missing when HAVE_LIBDL is undefined). (Tony) Fixed bug #51273 (Faultstring property does not exist when the faultstring is empty) (Ilia, dennis at transip dot nl) Fixed bug #51269 (zlib.output_compression Overwrites Vary Header). (Adam) Fixed bug #51257 (CURL_VERSION_LARGEFILE incorrectly used after libcurl version 7.10.1). (aron dot ujvari at microsec dot hu) Fixed bug #51242 (Empty mysql.default_port does not default to 3306 anymore, but 0). (Adam) Fixed bug #51237 (milter SAPI crash on startup). (igmar at palsenberg dot com) Fixed bug #51213 (pdo_mssql is trimming value of the money column). (Ilia, alexr at oplot dot com) Fixed bug #51190 (ftp_put() returns false when transfer was successful). (Ilia) Fixed bug #51183 (ext/date/php_date.c fails to compile with Sun Studio). (Sriram Natarajan) Fixed bug #51176 (Static calling in non-static method behaves like $this->). (Felipe) Fixed bug #51171 (curl_setopt() doesn't output any errors or warnings when an invalid option is provided). (Ilia) Fixed bug #51128 (imagefill() doesn't work with large images). (Pierre) Fixed bug #51096 ('last day' and 'first day' are handled incorrectly when parsing date strings). (Derick) Fixed bug #51086 (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones) Fixed bug #51062 (DBA DB4 uses mismatched headers and libraries). (Chris Jones) Fixed bug #51026 (mysqli_ssl_set not working). (Andrey) Fixed bug #51023 (filter doesn't detect int overflows with GCC 4.4). (Raphael Geissert) Fixed bug #50999 (unaligned memory access in dba_fetch()). (Felipe) Fixed bug #50976 (Soap headers Authorization not allowed). (Brain France, Dmitry) Fixed bug #50828 (DOMNotation is not subclass of DOMNode). (Rob) Fixed bug #50810 (property_exists does not work for private). (Felipe) Fixed bug #50762 (in WSDL mode Soap Header handler function only being called if defined in WSDL). (mephius at gmail dot com) Fixed bug #50731 (Inconsistent namespaces sent to functions registered with spl_autoload_register). (Felipe) Fixed bug #50563 (removing E_WARNING from parse_url). (ralph at smashlabs dot com, Pierre) Fixed bug #50578 (incorrect shebang in phar.phar). (Fedora at FamilleCollet dot com) Fixed bug #50555 (DateTime::sub() allows 'relative' time modifications). (Derick) Fixed bug #50392 (date_create_from_format enforces 6 digits for 'u' format character). (Derick) Fixed bug #50383 (Exceptions thrown in __call / __callStatic do not include file and line in trace). (Felipe) Fixed bug #50358 (Compile failure compiling ext/phar/util.lo). (Felipe) Fixed bug #50101 (name clash between global and local variable). (patch by yoarvi at gmail dot com) Fixed bug #51002 (fix possible memory corruption with very long names). (Pierre) Fixed bug #49893 (Crash while creating an instance of Zend_Mail_Storage_Pop3). (Dmitry) Fixed bug #49819 (STDOUT losing data with posix_isatty()). (Mike) Fixed bug #49778 (DateInterval::format("%a") is always zero when an interval is created from an ISO string). (Derick) Fixed bug #49700 (memory leaks in php_date.c if garbage collector is enabled). (Dmitry) Fixed bug #49576 (FILTER_VALIDATE_EMAIL filter needs updating) (Rasmus) Fixed bug #49490 (XPath namespace prefix conflict). (Rob) Fixed bug #49429 (odbc_autocommit doesn't work). (Felipe) Fixed bug #49320 (PDO returns null when SQLite connection fails). (Felipe) Fixed bug #49234 (mysqli_ssl_set not found). (Andrey) Fixed bug #49216 (Reflection doesn't seem to work properly on MySqli). (Andrey) Fixed bug #49192 (PHP crashes when GC invoked on COM object). (Stas) Fixed bug #49081 (DateTime::diff() mistake if start in January and interval > 28 days). (Derick) Fixed bug #49059 (DateTime::diff() repeats previous sub() operation). (yoarvi@gmail.com, Derick) Fixed bug #48983 (DomDocument : saveHTMLFile wrong charset). (Rob) Fixed bug #48930 (__COMPILER_HALT_OFFSET__ incorrect in PHP >= 5.3). (Felipe) Fixed bug #48902 (Timezone database fallback map is outdated). (Derick) Fixed bug #48781 (Cyclical garbage collector memory leak). (Dmitry) Fixed bug #48601 (xpath() returns FALSE for legitimate query). (Rob) Fixed bug #48361 (SplFileInfo::getPathInfo should return the parent dir). (Etienne) Fixed bug #48289 (iconv_mime_encode() quoted-printable scheme is broken). (Adam, patch from hiroaki dot kawai at gmail dot com). Fixed bug #47842 (sscanf() does not support 64-bit values). (Mike) Fixed bug #46111 (Some timezone identifiers can not be parsed). (Derick) Fixed bug #45808 (stream_socket_enable_crypto() blocks and eats CPU). (vincent at optilian dot com) Fixed bug #43233 (sasl support for ldap on Windows). (Pierre) Fixed bug #35673 (formatOutput does not work with saveHTML). (Rob) Fixed bug #33210 (getimagesize() fails to detect width/height on certain JPEGs). (Ilia)
The buglinks are of course for the PHP site.
this bug is useless. just pasting two screens of crap doesn't help anyone.
Please add updated dev-lang/php-5.3.3 to the tree, it fixes CVEs listed in summary.
Pls re-assign bug to php dev herd.
I'll be duping it against the proper bug with the next change. Don't even think about reopening this thing again.
*** This bug has been marked as a duplicate of bug 332039 ***
