Thema: Neue Versionen der Skriptsprache PHP

[SiLæncer]

PHP 5.6 erhält ab sofort nur noch Sicherheitspatches, ältere PHP-5-Versionen sind komplett aus dem Support gelaufen. Trotzdem wird das aktuelle PHP 7 noch recht wenig eingesetzt.

PHP 5 hat zum 1. Januar 2017 das Ende der aktiven Supportphase erreicht: Die anstehende Version 5.6.30 wird das letzte reguläre PHP-5-Release sein. Eine Weiterentwicklung von PHP 5 findet ab sofort nicht mehr statt. Die Entwickler versprechen allerdings, kritische Sicherheitslöcher in PHP 5.6 noch bis Ende 2019 zu stopfen.

Alle älteren PHP-5-Versionen sind bereits komplett aus dem Support gelaufen und erhalten auch keine Sicherheitspatches mehr. Nutzer älterer PHP-5-Versionen sollten daher dringend auf PHP 5.6 upgraden – oder gleich auf die die im Dezember 2015 veröffentlichte aktuelle PHP-Version 7 springen. Für Letzteres spricht, dass erste PHP-Frameworks bereits das Ende der PHP-5- Unterstützung in Aussicht stellen.

Noch viel PHP 5 im Einsatz

Die Web-Statistiker von W3tech finden PHP 7 lediglich auf 2,5% der untersuchten Websites, die PHP nutzen. PHP 5.6 ist auf 21% der PHP-Sites im Einsatz, der Rest verteilt sich auf ältere, nicht mehr gepflegte PHP-Versionen. Laut W3tech nutzen über 80% der 10 Millionen populärsten Websites PHP.

Ein etwas freundlicheres Bild zeichnet die Statistik von packagist.org, dem Standard-Repository des PHP-Package-Managers Compose: Hier kamen PHP 7.0 und 7.1 im November 2016 zusammen immerhin auf gut 36% der Zugriffe, PHP 5.6 auf 37%. Aber auch bei packagist.org erfolgen ein Viertel der Zugriffe mit veralteten PHP-Versionen.

Quelle : www.heise.de

[SiLæncer]

Changelog

Version 7.1.1
19 Jan 2017

    Core
        Fixed bug #73792 (invalid foreach loop hangs script).
        Fixed bug #73686 (Adding settype()ed values to ArrayObject results in references).
        Fixed bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created with list()).
        Fixed bug #73727 (ZEND_MM_BITSET_LEN is "undefined symbol" in zend_bitset.h).
        Fixed bug #73753 (unserialized array pointer not advancing).
        Fixed bug #73783 (SIG_IGN doesn't work when Zend Signals is enabled).
        Fixed bug #73825 (Heap out of bounds read on unserialize in finish_nested_data()).
        Fixed bug #73831 (NULL Pointer Dereference while unserialize php object).
        Fixed bug #73832 (Use of uninitialized memory in unserialize()).
    CLI
        Fixed bug #72555 (CLI output(japanese) on Windows).
    COM
        Fixed bug #73679 (DOTNET read access violation using invalid codepage).
    DOM
        Fixed bug #67474 (getElementsByTagNameNS filter on default ns).
    EXIF
        Fixed bug #73737 (FPE when parsing a tag format).
    GD
        Fixed bug #73869 (Signed Integer Overflow gd_io.c).
        Fixed bug #73868 (DOS vulnerability in gdImageCreateFromGd2Ctx()).
    mbstring
        Fixed bug #73646 (mb_ereg_search_init null pointer dereference).
    MySQLi
        Fixed bug #73462 (Persistent connections don't set $connect_errno).
    mysqlnd
        Optimized handling of BIT fields - less memory copies and lower memory usage.
        Fixed bug #73800 (sporadic segfault with MYSQLI_OPT_INT_AND_FLOAT_NATIVE).
    opcache
        Fixed bug #73789 (Strange behavior of class constants in switch/case block).
        Fixed bug #73746 (Method that returns string returns UNKNOWN:0 instead).
        Fixed bug #73654 (Segmentation fault in zend_call_function).
        Fixed bug #73668 ("SIGFPE Arithmetic exception" in opcache when divide by minus 1).
        Fixed bug #73847 (Recursion when a variable is redefined as array).
    PDO Firebird
        Fixed bug #72931 (PDO_FIREBIRD with Firebird 3.0 not work on returning statement).
    phpdbg
        Fixed bug #73794 (Crash (out of memory) when using run and # command separator).
        Fixed bug #73704 (phpdbg shows the wrong line in files with shebang).
    SQLite3
        Reverted fix for Fixed bug #73530 (Unsetting result set may reset other result set).
    Standard
        Fixed bug #73594 (dns_get_record does not populate $additional out parameter).
        Fixed bug #70213 (Unserialize context shared on double class lookup).
        Fixed bug #73154 (serialize object with __sleep function crash).
        Fixed bug #70490 (get_browser function is very slow).
        Fixed bug #73265 (Loading browscap.ini at startup causes high memory usage).
        (add subject to mail log).
        Fixed bug #31875 (get_defined_functions additional param to exclude disabled functions).
    zlib
        Fixed bug #73373 (deflate_add does not verify that output was not truncated).

[close]

http://www.php.net/

[SiLæncer]

Changelog

Core:
Fixed bug #73989 (PHP 7.1 Segfaults within Symfony test suite).
Fixed bug #74084 (Out of bound read - zend_mm_alloc_small).
Fixed bug #73807 (Performance problem with processing large post request).
Fixed bug #73998 (array_key_exists fails on arrays created by get_object_vars).
Fixed bug #73954 (NAN check fails on Alpine Linux with musl).
Fixed bug #74039 (is_infinite(-INF) returns false).
Fixed bug #73677 (Generating phar.phar core dump with gcc ASAN enabled build).
Apache:
Fixed bug #61471 (Incomplete POST does not timeout but is passed to PHP).
Date:
Fixed bug #72719 (Relative datetime format ignores weekday on sundays only).
Fixed bug #73294 (DateTime wrong when date string is negative).
Fixed bug #73489 (wrong timestamp when call setTimeZone multi times with UTC offset).
Fixed bug #73858 (first/last day of' flag is not being reset).
Fixed bug #73942 ($date->modify('Friday this week') doesn't return a Friday if $date is a Sunday).
Fixed bug #74057 (wrong day when using "this week" in strtotime).
FPM:
Fixed bug #69860 (php-fpm process accounting is broken with keepalive).
Hash:
Fixed bug #73127 (gost-crypto hash incorrect if input data contains long 0xFF sequence).
GD:
Fixed bug #74031 (ReflectionFunction for imagepng is missing last two parameters).
Mysqlnd:
Fixed bug #74021 (fetch_array broken data. Data more then MEDIUMBLOB).
Opcache:
Fixed bug #74152 (if statement says true to a null variable).
Fixed bug #74019 (Segfault with list).
OpenSSL:
Fixed bug #74022 (PHP Fast CGI crashes when reading from a pfx file).
Standard:
Fixed bug #74148 (ReflectionFunction incorrectly reports the number of arguments).
Fixed bug #74005 (mail.add_x_header causes RFC-breaking lone line feed).
Fixed bug #73118 (is_callable callable name reports misleading value for anonymous classes).
Fixed bug #74105 (PHP on Linux should use /dev/urandom when getrandom is not available).
Streams:
Fixed bug #73496 (Invalid memory access in zend_inline_hash_func).
Fixed bug #74090 (stream_get_contents maxlength>-1 returns empty string).

[close]

http://www.php.net/

[SiLæncer]

Changelog

Core:
Fixed bug #74149 (static embed SAPI linkage error).
Fixed bug #73370 (falsely exits with "Out of Memory" when using
USE_ZEND_ALLOC=0).
Fixed bug #73960 (Leak with instance method calling static method with
referenced return).
Fixed bug #69676 (Resolution of self::FOO in class constants not correct).
Fixed bug #74265 (Build problems after 7.0.17 release: undefined reference
to `isfinite').
Fixed bug #74302 (yield fromLABEL is over-greedy).
Apache:
Reverted patch for bug #61471, fixes bug #74318.
Date:
Fixed bug #72096 (Swatch time value incorrect for dates before 1970).
DOM:
Fixed bug #74004 (LIBXML_NOWARNING flag ingnored on loadHTML*).
iconv:
Fixed bug #74230 (iconv fails to fail on surrogates).
Opcache:
Fixed bug #74250 (OPcache compilation performance regression in PHP 5.6/7 with huge classes).
OpenSSL:
Fixed bug #72333 (fwrite() on non-blocking SSL sockets doesn't work).
PDO MySQL:
Fixed bug #71003 (Expose MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT to PDO interface).
SPL:
Fixed bug #74058 (ArrayObject can not notice changes).
Sqlite:
Implemented FR #74217 (Allow creation of deterministic sqlite functions).
Streams:
Fixed bug #74216 (Correctly fail on invalid IP address ports).
Zlib:
Fixed bug #74240 (deflate_add can allocate too much memory).

[close]

http://www.php.net/

[SiLæncer]

Changelog

Core:
Fixed bug #74600 (crash (SIGSEGV) in _zend_hash_add_or_update_i).
(Laruence)
Fixed bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
(Laruence)
intl:
Fixed bug #74468 (wrong reflection on Collator::sortWithSortKeys)(villfa)
MySQLi:
Fixed bug #74547 (mysqli::change_user() doesn't accept null as $database
argument w/strict_types)(Anatol)
Opcache:
Fixed bug #74596 (SIGSEGV with opcache.revalidate_path enabled)(Laruence)
phar:
Fixed bug #51918 (Phar::webPhar() does not handle requests sent through PUT
and DELETE method)(Christian Weiske)
Standard:
Fixed bug #74510 (win32/sendmail.c anchors CC header but not BCC).
(Damian Wadley, Anatol)
xmlreader:
Fixed bug #74457 (Wrong reflection on XMLReader::expand)(villfa)

[close]

http://www.php.net/

[SiLæncer]

Changelog

Core:
Fixed bug #74600 (crash (SIGSEGV) in _zend_hash_add_or_update_i).
Fixed bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
Fixed bug #74589 (__DIR__ wrong for unicode character).
intl:
Fixed bug #74468 (wrong reflection on Collator::sortWithSortKeys).
MySQLi:
Fixed bug #74547 (mysqli::change_user() doesn't accept null as $database argument w/strict_types).
Opcache:
Fixed bug #74596 (SIGSEGV with opcache.revalidate_path enabled).
phar:
Fixed bug #51918 (Phar::webPhar() does not handle requests sent through PUT and DELETE method).
Readline:
Fixed bug #74490 (readline() moves the cursor to the beginning of the line).
Standard:
Fixed bug #74510 (win32/sendmail.c anchors CC header but not BCC).
xmlreader:
Fixed bug #74457 (Wrong reflection on XMLReader::expand).

[close]

http://www.php.net/

[SiLæncer]

Changelog

Core:

    Fixed bug #74738 (Multiple [PATH=] and [HOST=] sections not properly parsed).
    Fixed bug #74658 (Undefined constants in array properties result in broken properties).
    Fixed misparsing of abstract unix domain socket names.
    Fixed bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability).
    Fixed bug #74101, bug #74614 (Unserialize Heap Use-After-Free (READ: 1) in zval_get_type).
    Fixed bug #74111 (Heap buffer overread (READ: 1) finish_nested_data from unserialize).
    Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via php_parse_date()).

Date:

    Fixed bug #74639 (implement clone for DatePeriod and DateInterval).

DOM:

    Fixed bug #69373 (References to deleted XPath query results).

GD:

    Fixed bug #74435 (Buffer over-read into uninitialized memory).

Intl:

    Fixed bug #73473 (Stack Buffer Overflow in msgfmt_parse_message).
    Fixed bug #74705 (Wrong reflection on Collator::getSortKey and collator_get_sort_key).

Mbstring:

    Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)

OCI8:

    Add TAF callback (PR #2459).

Opcache:

    Fixed bug #74663 (Segfault with opcache.memory_protect and validate_timestamp).
    Revert opcache.enable_cli to default disabled.

OpenSSL:

    Fixed bug #74720 (pkcs7_en/decrypt does not work if \x1a is used in content).
    Fixed bug #74651 (negative-size-param (-1) in memcpy in zif_openssl_seal()).

PDO_OCI:

    Support Instant Client 12.2 in --with-pdo-oci configure option.

Reflection:

    Fixed bug #74673 (Segfault when cast Reflection object to string with undefined constant).

SPL:

    Fixed bug #74478 (null coalescing operator failing with SplFixedArray).

FTP:

    Fixed bug #74598 (ftp:// wrapper ignores context arg).

PHAR:

    Fixed bug #74386 (Phar::__construct reflection incorrect).

SOAP:

    Fixed bug #74679 (Incorrect conversion array with WSDL_CACHE_MEMORY).

Streams:

    Fixed bug #74556 (stream_socket_get_name() returns '\0').

[close]

http://www.php.net/

[SiLæncer]

Whats new :>>

The much anticipated Sodium extension
Opcache improvements
Countable support for DOMNodeList and DOMNamedNodeMap
Improved handling for invalid UTF8 in json_decode()
And many bugfixes

http://www.php.net/

[SiLæncer]

Changelog

Core:
Fixed bug #74947 (Segfault in scanner on INF number).
Fixed bug #74954 (null deref and segfault in zend_generator_resume()).
Fixed bug #74725 (html_errors=1 breaks unhandled exceptions).
Fixed bug #75063 (Main CWD initialized with wrong codepage).
cURL:
Fixed bug #74125 (Fixed finding CURL on systems with multiarch support).
Date:
Fixed bug #75002 (Null Pointer Dereference in timelib_time_clone).
Intl:
Fixed bug #74993 (Wrong reflection on some locale_* functions).
Mbstring:
Fixed bug #71606 (Segmentation fault mb_strcut with HTML-ENTITIES encoding).
cmb)
Fixed bug #62934 (mb_convert_kana() does not convert iteration marks).
Nikita)
Fixed bug #75001 (Wrong reflection on mb_eregi_replace).
MySQLi:
Fixed bug #74968 (PHP crashes when calling mysqli_result::fetch_object with an abstract class).
OCI8:
Expose oci_unregister_taf_callback()
Opcache:
Fixed bug #74980 (Narrowing occurred during type inference).
phar:
Fixed bug #74991 (include_path has a 4096 char limit in some cases).
Reflection:
Fixed bug #74949 (null pointer dereference in _function_string).
Session:
Fixed bug #74892 (Url Rewriting (trans_sid) not working on urls that start with "#").
Fixed bug #74833 (SID constant created with wrong module number).
SimpleXML:
Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces).
SPL:
Fixed bug #75049 (spl_autoload_unregister can't handle spl_autoload_functions results).
Fixed bug #74669 (Unserialize ArrayIterator broken).
Fixed bug #74977 (Appending AppendIterator leads to segfault).
Fixed bug #75015 (Crash in recursive iterator destructors).
Standard:
Fixed bug #75075 (unpack with X* causes infinity loop).
Fixed bug #74103 (heap-use-after-free when unserializing invalid array size).
Fixed bug #75054 (A Denial of Service Vulnerability was found when performing deserialization).
WDDX:
Fixed bug #73793 (WDDX uses wrong decimal seperator).
XMLRPC:
Fixed bug #74975 (Incorrect xmlrpc serialization for classes with declared properties).

[close]

http://www.php.net/

[SiLæncer]

Infos zu dieser Version: http://php.net/archive/2017.php#id2017-09-14-1

http://www.php.net/

[SiLæncer]

Changelog

Core:

Fixed bug #75042 (run-tests.php issues with EXTENSION block).

BCMath:

Fixed bug #44995 (bcpowmod() fails if scale != 0).
Fixed bug #46781 (BC math handles minus zero incorrectly).
Fixed bug #54598 (bcpowmod() may return 1 if modulus is 1).
Fixed bug #75178 (bcpowmod() misbehaves for non-integer base or modulus).

CLI server:

Fixed bug #70470 (Built-in server truncates headers spanning over TCP packets).

CURL:

Fixed bug #75093 (OpenSSL support not detected).

GD:

Fixed bug #75124 (gdImageGrayScale() may produce colors).
Fixed bug #75139 (libgd/gd_interpolation.c:1786: suspicious if ?).

Gettext:

Fixed bug #73730 (textdomain(null) throws in strict mode).

Intl:

Fixed bug #75090 (IntlGregorianCalendar doesn't have constants from parent class).
Fixed bug #75193 (segfault in collator_convert_object_to_string).

PDO_OCI:

Fixed bug #74631 (PDO_PCO with PHP-FPM: OCI environment initialized before PHP-FPM sets it up).

SPL:

Fixed bug #75155 (AppendIterator::append() is broken when appending another AppendIterator).
Fixed bug #75173 (incorrect behavior of AppendIterator::append in foreach loop).

Standard:

Fixed bug #75152 (signed integer overflow in parse_iv).
Fixed bug #75097 (gethostname fails if your host name is 64 chars long).

[close]

http://www.php.net/

[SiLæncer]

Changelog

Core
Fixed bug #75220 (Segfault when calling is_callable on parent)
(andrewnester)
Fixed bug #75290 (debug info of Closures of internal functions contain
garbage argument names)(Andrea)
Apache2Handler:
Fixed bug #75311 (error: 'zend_hash_key' has no member named 'arKey' in
apache2handler)(mcarbonneaux)
Date:
Fixed bug #75222 (DateInterval microseconds property always 0)(jhdxr)
Hash:
Fixed Bug #75284 (sha3 is not supported on bigendian machine)(Remi)
Intl:
Fixed bug #75318 (The parameter of UConverter::getAliases() is not
optional)(cmb)
litespeed:
Fixed bug #75248 (Binary directory doesn't get created when building
only litespeed SAPI)(petk)
Fixed bug #75251 (Missing program prefix and suffix)(petk)
OCI8:
Fixed incorrect reference counting(Dmitry, Tianfang Yang)
Opcache
Fixed bug #75255 (Request hangs and not finish)(Dmitry)
PCRE:
Fixed bug #75285 (Broken build when system libpcre don't have jit support).
(Remi)
Sodium:
Added missing bindings for libsodium > 1.0.13(Frank)

[close]

http://www.php.net/

[SiLæncer]

Changelog

Core:

    Fixed bug #75241 (Null pointer dereference in zend_mm_alloc_small()).
    Fixed bug #75236 (infinite loop when printing an error-message).
    Fixed bug #75252 (Incorrect token formatting on two parse errors in one request).
    Fixed bug #75220 (Segfault when calling is_callable on parent).
    Fixed bug #75290 (debug info of Closures of internal functions contain garbage argument names).

Apache2Handler:

    Fixed bug #75311 (error: 'zend_hash_key' has no member named 'arKey' in apache2handler).

Date:

    Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()).

Intl:

    Fixed bug #75318 (The parameter of UConverter::getAliases() is not optional).

mcrypt:

    Fixed bug #72535 (arcfour encryption stream filter crashes php).

OCI8:

    Fixed incorrect reference counting.

PCRE:

    Fixed bug #75207 (applied upstream patch for CVE-2016-1283).

litespeed:

    Fixed bug #75248 (Binary directory doesn't get created when building only litespeed SAPI).
    Fixed bug #75251 (Missing program prefix and suffix).

SPL:

    Fixed bug #73629 (SplDoublyLinkedList::setIteratorMode masks intern flags).

[close]

http://www.php.net/

[SiLæncer]

Changelog

- Core:
  . Fixed bug #75368 (mmap/munmap trashing on unlucky allocations). (Nikita,
    Dmitry)

- CLI:
  . Fixed bug #75287 (Builtin webserver crash after chdir in a shutdown
    function). (Laruence)

- Date:
  . Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()). (Derick)

- Enchant:
  . Fixed bug #53070 (enchant_broker_get_path crashes if no path is set). (jelle
    van der Waa, cmb)
  . Fixed bug #75365 (Enchant still reports version 1.1.0). (cmb)

- Exif:
  . Fixed bug #75301 (Exif extension has built in revision version). (Peter
    Kokot)

- Fileinfo:
  . Upgrade bundled libmagic to 5.31. (Anatol)

- GD:
  . Fixed bug #65148 (imagerotate may alter image dimensions). (cmb)

- Intl:
  . Fixed bug #75378 ([REGRESSION] IntlDateFormatter::parse() does not change
    $position argument). (Laruence)
  . Fixed bug #75317 (UConverter::setDestinationEncoding changes source instead
    of destination). (andrewnester)

- JSON:
  . Fixed bug #68567 (JSON_PARTIAL_OUTPUT_ON_ERROR can result in JSON with null
    key). (Jakub Zelenka)

- OCI8:
  . Fixed valgrind issue. (Tianfang Yang)

- Opcache:
  . Fixed bug (assertion fails with extended info generated). (Laruence)
  . Fixed bug (Phi sources removel). (Laruence)
  . Fixed bug #75370 (Webserver hangs on valid PHP text). (Laruence)
  . Fixed bug #75357 (segfault loading WordPress wp-admin). (Laruence)
  . Fixed bug #75373 (Warning Internal error: wrong size calculation). (Laruence, Dmitry)

- Openssl:
  . Fixed bug #75363 (openssl_x509_parse leaks memory). (Bob)

- PCRE:
  . Fixed bug #75207 (applied upstream patch for CVE-2016-1283). (Anatol)

- PGSQL:
  . Fixed bug #75419 (Default link incorrectly cleared/linked by pg_close()). (Sara)

- Standard:
  . Fixed bug #75221 (Argon2i always throws NUL at the end). (cmb)

- Zlib:
  . Fixed bug #75299 (Wrong reflection on inflate_init and inflate_add). (Fabien
Villepinte)

[close]

http://www.php.net/

[SiLæncer]

Changelog

Date:

    Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()).

mcrypt:

    Fixed bug #72535 (arcfour encryption stream filter crashes php).

PCRE:

    Fixed bug #75207 (applied upstream patch for CVE-2016-1283).

[close]

http://www.php.net/