summaryrefslogtreecommitdiff
path: root/package/php/php.hash
AgeCommit message (Collapse)Author
2017-01-23php: bump version to 7.1.1Vicente Olivert Riera
0006-Fix-php-fpm.service.in.patch already included: https://github.com/php/php-src/commit/bb19125781c0794da9a63fee62e263ff4efff661 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-01-10php: bump version to 7.1.0 (security)Vicente Olivert Riera
Fixed CVEs: - CVE-2016-9933 (imagefilltoborder stackoverflow on truecolor images) http://bugs.php.net/72696 - CVE-2016-9934 (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow) http://bugs.php.net/73331 Full ChangeLog: http://php.net/ChangeLog-7.php#7.1.0 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-12-09php: security bump to version 7.0.14Gustavo Zacarias
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-11-11php: bump version to 7.0.13Vicente Olivert Riera
Release notes: http://php.net/ChangeLog-7.php#7.0.13 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-10-14php: security bump to version 7.0.12Gustavo Zacarias
See http://www.php.net/ChangeLog-7.php#7.0.12 since there are no CVEs out yet. And drop upstream patch. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-09-17php: bump to 7.0.11Tatsuyuki Ishi
Signed-off-by: Tatsuyuki Ishi <ishitatsuyuki@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-07-21php: bump version to 7.0.9Vicente Olivert Riera
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-06-26package/php: security bump version to 7.0.8Bernd Kuhls
Changelog is available here: http://php.net/ChangeLog-7.php#7.0.8 Fixes CVE-2015-8874 http://bugs.php.net/66387 Fixes CVE-2016-5766 http://bugs.php.net/72339 Fixes CVE-2016-5767 http://bugs.php.net/72446 Fixes CVE-2016-5768 http://bugs.php.net/72402 Fixes CVE-2016-5769 http://bugs.php.net/72455 Fixes CVE-2016-5772 http://bugs.php.net/72340 Fixes CVE-2016-5773 http://bugs.php.net/72434 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-06-01php: security bump version to 7.0.7Vicente Olivert Riera
Fixes CVE-2013-7456 https://bugs.php.net/bug.php?id=72227 Fixes CVE-2016-5093 https://bugs.php.net/bug.php?id=72241 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-05-31php: bump version to 7.0.6Vicente Olivert Riera
Remove MySQL legacy extension. Remove incompatible external modules: - php-gnupg - php-memcached - php-ssh2 - php-yaml Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-04-29php: security bump to version 5.6.21Gustavo Zacarias
Fixes (CVEs not assigned yet): bug #72094 - Out of bounds heap read access in exif header processing bug #71912 - libgd: signedness vulnerability bug #72061 - Out-of-bounds reads in zif_grapheme_stripos with negative offset bug #71843 - null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER bug #71952 - Corruption inside imageaffinematrixget Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-04-02php: security bump to version 5.6.20Gustavo Zacarias
Fixes (no CVEs yet): Buffer over-write in finfo_open with malformed magic file. Invalid memory write in phar on filename with \0 in name. Parsing of tar file with duplicate filenames causes memory leak. php_snmp_error() Format String Vulnerability. Integer Overflow in php_raw_url_encode. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-03-04php: bump to version 5.6.19Gustavo Zacarias
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-02-05package/php: security bump version to 5.6.18Bernd Kuhls
Changelog: http://www.php.net/ChangeLog-5.php#5.6.18 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-01-08php: security bump to version 5.6.17Gustavo Zacarias
Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). Bug #70755 (fpm_log.c memory leak and buffer overflow). Bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization). Bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability). Bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()). No CVEs assigned yet. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-11-28package/php: bump version to 5.6.16Bernd Kuhls
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-10-31php: bump to version 5.6.15Gustavo Zacarias
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-10-02php: bump to version 5.6.14Gustavo Zacarias
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-09-06package/php: security bump to version 5.6.13Bernd Kuhls
Link to release announcement: http://php.net/archive/2015.php#id2015-09-04-2 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-08-10package/php: security bump to version 5.6.12Bernd Kuhls
http://www.php.net/ChangeLog-5.php#5.6.12 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-11php: security bump to version 5.6.11Gustavo Zacarias
Fixes: CVE-2015-3152 - mysqlnd is vulnerable to BACKRONYM And other security bugs with no CVE assigned yet: Bug #69972 - Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk() Bug # 69970 - Use-after-free vulnerability in spl_recursive_it_move_forward_ex() Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-06-12php: security bump to version 5.6.10Gustavo Zacarias
Fixes: CVE-2015-3414, CVE-2015-3415, CVE-2015-3416 (via bundled sqlite upgrade). CVE-2015-2325, CVE-2015-2326 (via bundled pcre upgrade). Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-05-20php: bump version to 5.6.9Floris Bos
Signed-off-by: Floris Bos <bos@je-eigen-domein.nl> Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-04-17php: security bump to version 5.6.8Gustavo Zacarias
Fixes: CVE-2015-1351 - OPCache: Use After Free CVE-2015-1352 - Postgres: Null pointer dereference And others with no CVE assigned yet. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-04-08php: bump to version 5.6.7Gustavo Zacarias
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-03-20php: security bump to version 5.5.23Gustavo Zacarias
Fixes: CVE-2015-0231 - Use After Free Vulnerability in unserialize() CVE-2015-2305 - heap overflow vulnerability in regcomp.c CVE-2015-2331 - ZIP Integer Overflow leads to writing past heap boundary Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-02-19php: security bump to version 5.5.22Gustavo Zacarias
Fixes: CVE-2015-0273 - Use after free vulnerability in unserialize() with DateTimeZone. CVE-2015-0235 - Mitigation for GHOST: glibc gethostbyname buffer overflow. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-01-23php: security bump to version 5.5.21Gustavo Zacarias
Fixes: CVE-2015-0231 - Use After Free Vulnerability in PHP's unserialize() CVE-2014-9427 - Out of bounds read crashes php-cgi CVE-2015-0232 - Free called on unitialized pointer Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-12-18php: security bump to version 5.5.20Gustavo Zacarias
Fixes: CVE-2014-8142 - Use after free vulnerability in unserialize() Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-11-14php: security bump to version 5.5.19Gustavo Zacarias
Fixes: CVE-2014-3710 - fileinfo: out-of-bounds read in elf note headers. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Reviewed-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Tested-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-10-17php: security bump to version 5.5.18Gustavo Zacarias
Fixes: CVE-2014-3669 - Integer overflow in unserialize() (32-bits only) CVE-2014-3670 - Heap corruption in exif_thumbnail() CVE-2014-3668 - Global buffer overflow in mkgmtime() function Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Acked-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-09-19php: bump to version 5.5.17Gustavo Zacarias
Add hash and switch to xz download for space savings. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-15 10:17:04 +0000