New PHP release fixes several vulnerabilities
The PHP development team announced the immediate availability of PHP 4.4.8. It continues to improve the security and the stability of the 4.4 branch and all users are strongly encouraged to upgrade.
This release wraps up all the outstanding patches for the PHP 4.4 series, and is therefore the last normal PHP 4.4 release. If necessary, releases to address security issues could be made until 2008-08-08.
Security enhancements and fixes in PHP 4.4.8:
- Improved fix for MOPB-02-2007.
- Fixed an integer overflow inside chunk_split(). Identified by Gerhard Wagner.
- Fixed integer overlow in str[c]spn().
- Fixed regression in glob when open_basedir is on introduced by #41655 fix.
- Fixed money_format() not to accept multiple %i or %n tokens.
- Addded “max_input_nesting_level” php.ini option to limit nesting level of input variables. Fix for MOPB-03-2007.
- Fixed INFILE LOCAL option handling with MySQL – now not allowed when open_basedir or safe_mode is active.
- Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378).
PHP 4.4.8 is available for download here.