Opened 2 years ago

Closed 2 years ago

Last modified 2 years ago

#12115 closed enhancement (fixed)

php-7.3.6

Reported by: Douglas R. Reno Owned by: thomas
Priority: high Milestone: 9.0
Component: BOOK Version: SVN
Severity: normal Keywords:
Cc:

Description

New point version

Change History (4)

comment:1 by thomas, 2 years ago

Owner: changed from blfs-book to thomas
Status: newassigned

Mostly bugfixes:

Version 7.3.6
30 May 2019

    cURL:
        Implemented FR #72189 (Add missing CURL_VERSION_* constants).
    EXIF:
        Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16) (CVE-2019-11040).
    FPM:
        Fixed bug #77934 (php-fpm kill -USR2 not working).
        Fixed bug #77921 (static.php.net doesn't work anymore).
    GD:
        Fixed bug #77943 (imageantialias($image, false); does not work).
        Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm) (CVE-2019-11038).
    Iconv:
        Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow) (CVE-2019-11039).
    JSON:
        Fixed bug #77843 (Use after free with json serializer).
    Opcache:
        Fixed possible crashes, because of inconsistent PCRE cache and opcache SHM reset.
    PDO_MySQL:
        Fixed bug #77944 (Wrong meta pdo_type for bigint on LLP64).
    Reflection:
        Fixed bug #75186 (Inconsistent reflection of Closure:::__invoke()).
    Session:
        Fixed bug #77911 (Wrong warning for session.sid_bits_per_character).
    SOAP:
        Fixed bug #77945 (Segmentation fault when constructing SoapClient with WSDL_CACHE_BOTH).
    SPL:
        Fixed bug #77024 (SplFileObject::__toString() may return array).
    SQLite:
        Fixed bug #77967 (Bypassing open_basedir restrictions via file uris).
    Standard:
        Fixed bug #77931 (Warning for array_map mentions wrong type).
        Fixed bug #78003 (strip_tags output change since PHP 7.3).

comment:2 by thomas, 2 years ago

Resolution: fixed
Status: assignedclosed

Fixed in r21648

comment:3 by Douglas R. Reno, 2 years ago

Priority: normalhigh

Back-documenting security fixes:

CVE-2019-11040: heap buffer overflow in php_jpg_get16
CVE-2019-11038: Uninitialized read in gdImageCreateFromXbm
CVE-2019-11039: Integer overflow causes out of bounds read

Also, retroactively bump to high priority.

comment:4 by Bruce Dubbs, 2 years ago

Milestone: 8.59.0

Milestone renamed

Note: See TracTickets for help on using tickets.