php-7.3.6

[Douglas R. Reno]

New point version

[thomas]

Mostly bugfixes:

Version 7.3.6
30 May 2019

    cURL:
        Implemented FR #72189 (Add missing CURL_VERSION_* constants).
    EXIF:
        Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16) (CVE-2019-11040).
    FPM:
        Fixed bug #77934 (php-fpm kill -USR2 not working).
        Fixed bug #77921 (static.php.net doesn't work anymore).
    GD:
        Fixed bug #77943 (imageantialias($image, false); does not work).
        Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm) (CVE-2019-11038).
    Iconv:
        Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow) (CVE-2019-11039).
    JSON:
        Fixed bug #77843 (Use after free with json serializer).
    Opcache:
        Fixed possible crashes, because of inconsistent PCRE cache and opcache SHM reset.
    PDO_MySQL:
        Fixed bug #77944 (Wrong meta pdo_type for bigint on LLP64).
    Reflection:
        Fixed bug #75186 (Inconsistent reflection of Closure:::__invoke()).
    Session:
        Fixed bug #77911 (Wrong warning for session.sid_bits_per_character).
    SOAP:
        Fixed bug #77945 (Segmentation fault when constructing SoapClient with WSDL_CACHE_BOTH).
    SPL:
        Fixed bug #77024 (SplFileObject::__toString() may return array).
    SQLite:
        Fixed bug #77967 (Bypassing open_basedir restrictions via file uris).
    Standard:
        Fixed bug #77931 (Warning for array_map mentions wrong type).
        Fixed bug #78003 (strip_tags output change since PHP 7.3).

[thomas]

Fixed in r21648

[Douglas R. Reno]

Back-documenting security fixes:

CVE-2019-11040: heap buffer overflow in php_jpg_get16
CVE-2019-11038: Uninitialized read in gdImageCreateFromXbm
CVE-2019-11039: Integer overflow causes out of bounds read

Also, retroactively bump to high priority.

[Bruce Dubbs]

Milestone renamed