summaryrefslogtreecommitdiffstats
path: root/package/php/php.hash
Commit message (Collapse)AuthorAgeFilesLines
* package/php: security bump to version 7.3.3Peter Korsgaard2019-03-251-1/+1
| | | | | | | | | | | | | | php-7.3.3 fixes a number of security issues (no CVE known, bugtracker issues not yet public): https://secure.php.net/ChangeLog-7.php#7.3.3 Drop 0004-OPcache-flock-mechanism-is-obviously-linux-so-force-.patch as the flock detection has been removed since commit 9222702633 (Avoid dependency on "struct flock" fields order.) Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> (cherry picked from commit b821ae3d63440258808e413b1ace53639066046a) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: security bump to version 7.3.2Bernd Kuhls2019-02-101-1/+1
| | | | | | | | | | Rebased patch 0004. This bump fixes https://bugs.php.net/bug.php?id=77369, status of CVE-ID: needed Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: security bump to 7.3.1Adam Duskett2019-01-191-1/+1
| | | | | | | | | | | | Fixes the following security issue: - CVE-2018-19935: Allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function. https://www.cvedetails.com/cve/CVE-2018-19935/ Signed-off-by: Adam Duskett <Aduskett@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.3.0Adam Duskett2018-12-281-1/+1
| | | | | | | | | | | | | | | | | Other changes: - Update patches so they cleanly apply. - Remove patch 5, as it no longer applies. - Remove conf env option ac_cv_func_strcasestr=yes because of the above. - libzip is no longer bundled with php, because of this, libzip must now be selected and depended on if the zip extension is selected. Signed-off-by: Adam Duskett <Aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* php: security bump to version 7.2.13Peter Korsgaard2018-12-081-1/+1
| | | | | | | | | | | | | | | Fixes CVE-2018-19518: University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.2.12Bernd Kuhls2018-11-081-2/+2
| | | | | | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.2.12 Rebased patch 0004 and updated license hash after white space removal: https://github.com/php/php-src/commit/902d39a3a79c6efe93c8879575fdd5a759cf03de Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.2.11Bernd Kuhls2018-10-201-1/+1
| | | | | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.2.11 Removed patch 0007, applied upstream. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: security bump to version 7.2.10Bernd Kuhls2018-09-131-1/+1
| | | | | | | | | Changelog: http://de2.php.net/ChangeLog-7.php#7.2.10 Fixes https://bugs.php.net/bug.php?id=76582, CVE ID pending. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/php: security bump to version 7.2.9Bernd Kuhls2018-08-181-1/+1
| | | | | | | | Version 7.2.8 fixed CVE-2018-12882, CVE-2018-14883 & CVE-2018-14851: http://www.php.net/ChangeLog-7.php#7.2.8 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/php: security bump to version 7.2.5Bernd Kuhls2018-04-281-1/+1
| | | | | | | | | | | | | | | | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.2.5 This release fixes several security-related bugs for which no CVE id's are assigned at the time of writing: https://bugs.php.net/bug.php?id=76129 https://bugs.php.net/bug.php?id=76130 https://bugs.php.net/bug.php?id=76248 https://bugs.php.net/bug.php?id=76249 Removed patch 0007, applied upstream: https://github.com/php/php-src/commit/2842aa2a078eb1cad55540b61e7edf111395150d Re-numbered patch 0009 -> 0007. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/php: security bump to version 7.2.4Bernd Kuhls2018-03-291-1/+1
| | | | | | | | | Fixes https://bugs.php.net/bug.php?id=75605, no CVE-ID yet. Removed patch 0008, applied upstream. Re-numbered patch 0009. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: security bump to version 7.2.3Bernd Kuhls2018-03-021-1/+1
| | | | | | | | | | Fixes CVE 2018-7584: https://bugs.php.net/bug.php?id=75981 For details see release notes: http://www.php.net/archive/2018.php#id2018-03-01-2 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump version to 7.2.2Adam Duskett2018-02-021-2/+2
| | | | | | | | | | Additional changes: - Fix ordering of patches. - Update patches to apply cleanly against 7.2.2 - Updates License sha256sum Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump to 7.2.1Adam Duskett2018-01-301-1/+1
| | | | | | | | Also update 0003-configure-disable-the-phar-tool.patch as configure.in is no longer provided in the tarballs. Instead, configure.ac is patched. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: security bump to 7.1.13Bernd Kuhls2018-01-071-1/+1
| | | | | | | | | | | Removed 0008-fix-asm-constraints-in-aarch64-multiply-macro.patch, patch was applied upstream: https://github.com/php/php-src/commit/d6d4f2a9b38cd7fa7e938142e49e5a514d612e52 Renumbered patch 0009. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: bump version to 7.1.12Bernd Kuhls2017-11-251-1/+1
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: bump version to 7.1.11Bernd Kuhls2017-10-281-1/+1
| | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.1.11 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.1.10Bernd Kuhls2017-10-031-1/+1
| | | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.1.10 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.1.9Bernd Kuhls2017-09-071-1/+1
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: security bump to version 7.1.7Peter Korsgaard2017-07-111-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2017-7890 - Buffer over-read into uninitialized memory. The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c (which can be reached with a call to the imagecreatefromstring() function) uses constant-sized color tables of size 3 * 256, but does not zero-out these arrays before use. CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229 - Out-of-bonds access in oniguruma regexp library. CVE-2017-11144 - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission. CVE-2017-11145 - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, lack of a bounds check in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to an ext/date/lib/parse_date.c out-of-bounds read affecting the php_parse_date function. CVE-2017-11146 - In PHP through 5.6.31, 7.x through 7.0.21, and 7.1.x through 7.1.7, lack of bounds checks in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11145. While we're at it, add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.1.6Bernd Kuhls2017-06-101-1/+1
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump version to 7.1.5Vicente Olivert Riera2017-05-151-1/+1
| | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump version to 7.1.4Vicente Olivert Riera2017-04-181-1/+1
| | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump version to 7.1.3Vicente Olivert Riera2017-03-161-1/+1
| | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump to version 7.1.2Peter Korsgaard2017-03-101-1/+1
| | | | | | | | 7.1.2 is a bugfix release, fixing a number of issues: http://www.php.net/ChangeLog-7.php#7.1.2 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump version to 7.1.1Vicente Olivert Riera2017-01-231-1/+1
| | | | | | | | 0006-Fix-php-fpm.service.in.patch already included: https://github.com/php/php-src/commit/bb19125781c0794da9a63fee62e263ff4efff661 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump version to 7.1.0 (security)Vicente Olivert Riera2017-01-101-1/+1
| | | | | | | | | | | | | | | Fixed CVEs: - CVE-2016-9933 (imagefilltoborder stackoverflow on truecolor images) http://bugs.php.net/72696 - CVE-2016-9934 (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow) http://bugs.php.net/73331 Full ChangeLog: http://php.net/ChangeLog-7.php#7.1.0 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: security bump to version 7.0.14Gustavo Zacarias2016-12-091-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump version to 7.0.13Vicente Olivert Riera2016-11-111-1/+1
| | | | | | | Release notes: http://php.net/ChangeLog-7.php#7.0.13 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump to version 7.0.12Gustavo Zacarias2016-10-141-1/+1
| | | | | | | | | | See http://www.php.net/ChangeLog-7.php#7.0.12 since there are no CVEs out yet. And drop upstream patch. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump to 7.0.11Tatsuyuki Ishi2016-09-171-1/+1
| | | | | Signed-off-by: Tatsuyuki Ishi <ishitatsuyuki@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump version to 7.0.9Vicente Olivert Riera2016-07-211-1/+1
| | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: security bump version to 7.0.8Bernd Kuhls2016-06-261-1/+1
| | | | | | | | | | | | | | | Changelog is available here: http://php.net/ChangeLog-7.php#7.0.8 Fixes CVE-2015-8874 http://bugs.php.net/66387 Fixes CVE-2016-5766 http://bugs.php.net/72339 Fixes CVE-2016-5767 http://bugs.php.net/72446 Fixes CVE-2016-5768 http://bugs.php.net/72402 Fixes CVE-2016-5769 http://bugs.php.net/72455 Fixes CVE-2016-5772 http://bugs.php.net/72340 Fixes CVE-2016-5773 http://bugs.php.net/72434 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump version to 7.0.7Vicente Olivert Riera2016-06-011-1/+1
| | | | | | | | Fixes CVE-2013-7456 https://bugs.php.net/bug.php?id=72227 Fixes CVE-2016-5093 https://bugs.php.net/bug.php?id=72241 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump version to 7.0.6Vicente Olivert Riera2016-05-311-1/+1
| | | | | | | | | | | | | Remove MySQL legacy extension. Remove incompatible external modules: - php-gnupg - php-memcached - php-ssh2 - php-yaml Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump to version 5.6.21Gustavo Zacarias2016-04-291-1/+1
| | | | | | | | | | | | Fixes (CVEs not assigned yet): bug #72094 - Out of bounds heap read access in exif header processing bug #71912 - libgd: signedness vulnerability bug #72061 - Out-of-bounds reads in zif_grapheme_stripos with negative offset bug #71843 - null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER bug #71952 - Corruption inside imageaffinematrixget Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: security bump to version 5.6.20Gustavo Zacarias2016-04-021-1/+1
| | | | | | | | | | | | Fixes (no CVEs yet): Buffer over-write in finfo_open with malformed magic file. Invalid memory write in phar on filename with \0 in name. Parsing of tar file with duplicate filenames causes memory leak. php_snmp_error() Format String Vulnerability. Integer Overflow in php_raw_url_encode. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump to version 5.6.19Gustavo Zacarias2016-03-041-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: security bump version to 5.6.18Bernd Kuhls2016-02-051-1/+1
| | | | | | | Changelog: http://www.php.net/ChangeLog-5.php#5.6.18 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump to version 5.6.17Gustavo Zacarias2016-01-081-1/+1
| | | | | | | | | | | | | | | | Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). Bug #70755 (fpm_log.c memory leak and buffer overflow). Bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization). Bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability). Bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()). No CVEs assigned yet. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 5.6.16Bernd Kuhls2015-11-281-1/+1
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump to version 5.6.15Gustavo Zacarias2015-10-311-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump to version 5.6.14Gustavo Zacarias2015-10-021-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: security bump to version 5.6.13Bernd Kuhls2015-09-061-1/+1
| | | | | | | | Link to release announcement: http://php.net/archive/2015.php#id2015-09-04-2 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: security bump to version 5.6.12Bernd Kuhls2015-08-101-1/+1
| | | | | | http://www.php.net/ChangeLog-5.php#5.6.12 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump to version 5.6.11Gustavo Zacarias2015-07-111-1/+1
| | | | | | | | | | | | | | Fixes: CVE-2015-3152 - mysqlnd is vulnerable to BACKRONYM And other security bugs with no CVE assigned yet: Bug #69972 - Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk() Bug # 69970 - Use-after-free vulnerability in spl_recursive_it_move_forward_ex() Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump to version 5.6.10Gustavo Zacarias2015-06-121-1/+1
| | | | | | | | | | Fixes: CVE-2015-3414, CVE-2015-3415, CVE-2015-3416 (via bundled sqlite upgrade). CVE-2015-2325, CVE-2015-2326 (via bundled pcre upgrade). Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump version to 5.6.9Floris Bos2015-05-201-1/+1
| | | | | | Signed-off-by: Floris Bos <bos@je-eigen-domein.nl> Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: security bump to version 5.6.8Gustavo Zacarias2015-04-171-1/+1
| | | | | | | | | | | Fixes: CVE-2015-1351 - OPCache: Use After Free CVE-2015-1352 - Postgres: Null pointer dereference And others with no CVE assigned yet. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump to version 5.6.7Gustavo Zacarias2015-04-081-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
OpenPOWER on IntegriCloud