PHP 5.6.14 is available

The PHP development team announced the immediate availability of PHP 5.6.14, published as a security release for the PHP 5.6 branch. The project explicitly recommended that all PHP 5.6 users upgrade to this version because it fixes two security vulnerabilities.  

Release and download notes

• Announcement: PHP 5.6.14 was announced as available immediately (a security release).  
• ChangeLog date: The PHP 5 ChangeLog records PHP 5.6.14 under 01 Oct 2015, along with the full list of fixes.  
• Downloads: The official announcement directs users to the PHP downloads page for source releases and to the Windows builds site for binaries.  

Security fixes (the main reason to upgrade)

PHP 5.6.14 addresses two security issues in the Phar extension, both of which could be triggered remotely in scenarios where an application processes attacker-controlled archives or Phar-related input.

1) CVE-2015-7803 — NULL pointer dereference in Phar

• Fixed a NULL pointer dereference in phar_get_fp_offset() that could lead to a crash (denial of service).  

2) CVE-2015-7804 — Uninitialized pointer in Phar zip directory stream handling

• Fixed an uninitialized pointer issue in phar_make_dirstream() when handling a zip entry filename of “/”. Depending on circumstances, this could cause a crash and may also create a risk of information disclosure.  

Security organizations and scanners also flagged versions prior to 5.6.14 as affected, reinforcing that this release is upgrade-worthy even if you “don’t care about new features.”  

Other notable bug fixes in PHP 5.6.14

While the headline is security, 5.6.14 also includes a set of practical bug fixes across core and common extensions. Highlights from the official ChangeLog:  

• Core
  • Build/extension tooling fix for FreeBSD 10 handling in bundled libtool.m4.  
• Built-in CLI Server
  • Fixed a 404 issue for URLs containing +.  
• DOM
  • Fixed behavior where assigning to DOMNode::textContent performed additional entity encoding.  
• LDAP
  • Fixed an issue where ldap_search() could modify LDAP option values (time limit / deref).
  • Fixed cases where LDAP timeouts weren’t enforced.  
• mysqlnd
  • Fixed behavior so TCP keep-alive becomes active when connecting to a server (when appropriate).  
• OpenSSL extension
  • Multiple fixes, including DH parameter handling, missing ARG_INFO for openssl_seal(), AES-related seal failures, and config lookup behavior.  
• PDO
  • Fixed a bug where the PDO constructor could change unrelated variables.  
• Streams
  • Fixed the HTTP stream wrapper not closing keep-alive connections properly.  
• Zip
  • ZipArchive::close() now reports errors correctly instead of silently succeeding.  

Quản lý và đồng bộ hóa môi trường chạy mã nguồn trên các hệ thống cũ luôn đòi hỏi sự cẩn trọng tối đa từ phía các kỹ sư vận hành. Sự bất đồng nhất về phiên bản giữa máy trạm và máy chủ rất dễ dẫn đến các lỗi hệ thống không đáng có trong quá trình triển khai dự án thực tế. Do đó, bạn có thể đọc thêm bài viết chia sẻ về [xCrawler nhiều node] để hiểu sâu hơn về những khó khăn, kinh nghiệm xương máu khi cấu hình môi trường đồng bộ trên nhiều máy chủ Ubuntu cùng một lúc