summaryrefslogtreecommitdiffstats
path: root/package/php/php.mk
Commit message (Collapse)AuthorAgeFilesLines
* php: security bump to version 7.2.13Peter Korsgaard2018-12-081-1/+1
| | | | | | | | | | | | | | | Fixes CVE-2018-19518: University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.2.12Bernd Kuhls2018-11-081-1/+1
| | | | | | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.2.12 Rebased patch 0004 and updated license hash after white space removal: https://github.com/php/php-src/commit/902d39a3a79c6efe93c8879575fdd5a759cf03de Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: add support for PostgreSQL (non-PDO)Bernd Kuhls2018-11-041-0/+6
| | | | | | | | Needed for example for phppgadmin. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Thomas: add missing BR2_USE_WCHAR dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/php: bump version to 7.2.11Bernd Kuhls2018-10-201-1/+1
| | | | | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.2.11 Removed patch 0007, applied upstream. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: security bump to version 7.2.10Bernd Kuhls2018-09-131-1/+1
| | | | | | | | | Changelog: http://de2.php.net/ChangeLog-7.php#7.2.10 Fixes https://bugs.php.net/bug.php?id=76582, CVE ID pending. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/php: security bump to version 7.2.9Bernd Kuhls2018-08-181-1/+1
| | | | | | | | Version 7.2.8 fixed CVE-2018-12882, CVE-2018-14883 & CVE-2018-14851: http://www.php.net/ChangeLog-7.php#7.2.8 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* php: use $() to reference make variables instead of ${}Ricardo Martincoski2018-07-081-1/+1
| | | | | Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
* package/php: security bump to version 7.2.5Bernd Kuhls2018-04-281-1/+1
| | | | | | | | | | | | | | | | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.2.5 This release fixes several security-related bugs for which no CVE id's are assigned at the time of writing: https://bugs.php.net/bug.php?id=76129 https://bugs.php.net/bug.php?id=76130 https://bugs.php.net/bug.php?id=76248 https://bugs.php.net/bug.php?id=76249 Removed patch 0007, applied upstream: https://github.com/php/php-src/commit/2842aa2a078eb1cad55540b61e7edf111395150d Re-numbered patch 0009 -> 0007. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* php: fix how PCRE JIT is disabledThomas Petazzoni2018-04-061-6/+4
| | | | | | | | | | | | | | | | | When the internal PCRE library of PHP is used, it tries to use a JIT engine, which is only available on some architectures. However, the mechanism used to disable JIT has changed in recent PHP versions, and it now has a proper --without-pcre-jit option. Switch over to that to properly disable JIT on unsupported platforms. It has been tested to fix the build of PHP on ARC and Microblaze. Fixes: http://autobuild.buildroot.net/results/e1359fcad7bc57e3c5a7ecc37abaa2cf6a6a9ffa/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/php: security bump to version 7.2.4Bernd Kuhls2018-03-291-1/+1
| | | | | | | | | Fixes https://bugs.php.net/bug.php?id=75605, no CVE-ID yet. Removed patch 0008, applied upstream. Re-numbered patch 0009. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: security bump to version 7.2.3Bernd Kuhls2018-03-021-1/+1
| | | | | | | | | | Fixes CVE 2018-7584: https://bugs.php.net/bug.php?id=75981 For details see release notes: http://www.php.net/archive/2018.php#id2018-03-01-2 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: disable valgrindAdam Duskett2018-02-131-0/+5
| | | | | | | | | | | | Introduced in PHP7.2, if a host has valgrind headers installed, PHP will detect them and set HAVE_VALGRIND to 1. Disable this entry after configuring. fixes: http://autobuild.buildroot.net/results/d59/d59b5961890aeddcd6d59ed52243be6554d1fe21 Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* php: bump version to 7.2.2Adam Duskett2018-02-021-1/+1
| | | | | | | | | | Additional changes: - Fix ordering of patches. - Update patches to apply cleanly against 7.2.2 - Updates License sha256sum Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump to 7.2.1Adam Duskett2018-01-301-1/+1
| | | | | | | | Also update 0003-configure-disable-the-phar-tool.patch as configure.in is no longer provided in the tarballs. Instead, configure.ac is patched. Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: security bump to 7.1.13Bernd Kuhls2018-01-071-1/+1
| | | | | | | | | | | Removed 0008-fix-asm-constraints-in-aarch64-multiply-macro.patch, patch was applied upstream: https://github.com/php/php-src/commit/d6d4f2a9b38cd7fa7e938142e49e5a514d612e52 Renumbered patch 0009. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: bump version to 7.1.12Bernd Kuhls2017-11-251-1/+1
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: bump version to 7.1.11Bernd Kuhls2017-10-281-1/+1
| | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.1.11 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.1.10Bernd Kuhls2017-10-031-1/+1
| | | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.1.10 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.1.9Bernd Kuhls2017-09-071-1/+1
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: security bump to version 7.1.7Peter Korsgaard2017-07-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2017-7890 - Buffer over-read into uninitialized memory. The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c (which can be reached with a call to the imagecreatefromstring() function) uses constant-sized color tables of size 3 * 256, but does not zero-out these arrays before use. CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229 - Out-of-bonds access in oniguruma regexp library. CVE-2017-11144 - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission. CVE-2017-11145 - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, lack of a bounds check in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to an ext/date/lib/parse_date.c out-of-bounds read affecting the php_parse_date function. CVE-2017-11146 - In PHP through 5.6.31, 7.x through 7.0.21, and 7.1.x through 7.1.7, lack of bounds checks in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11145. While we're at it, add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: use the new gettext logicThomas Petazzoni2017-07-051-1/+1
| | | | | | | | | | | | This commit switches to use the new gettext logic, which involves: - using TARGET_NLS_DEPENDENCIES instead of hand-encoded dependencies on gettext/host-gettext - dropping BR2_PACKAGE_GETTEXT selection. Thanks to this, we can drop the BR2_USE_WCHAR dependency Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: fix icu supportBernd Kuhls2017-06-101-1/+3
| | | | | | | | | | | | | | | | | Propagate icu reverse dependencies. Php lacks "-std=c++11", provided by icu-config, when compiling icu support leading to a build failure: /home/peko/autobuild/instance-1/output/host/usr/sh4-buildroot-linux-uclibc/sysroot/usr/include/unicode/umachine.h:347:13: error: 'char16_t' does not name a type typedef char16_t UChar; Fixes http://autobuild.buildroot.net/results/238/238d0e4bb205c0e7288903c6498e6c1787d86a1b/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: bump version to 7.1.6Bernd Kuhls2017-06-101-1/+1
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump version to 7.1.5Vicente Olivert Riera2017-05-151-1/+1
| | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump version to 7.1.4Vicente Olivert Riera2017-04-181-1/+1
| | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: add version to license stringRahul Bedarkar2017-04-011-1/+1
| | | | | | | As per LICENSE file, php uses PHP license version 3.01. Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump version to 7.1.3Vicente Olivert Riera2017-03-161-1/+1
| | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump to version 7.1.2Peter Korsgaard2017-03-101-1/+1
| | | | | | | | 7.1.2 is a bugfix release, fixing a number of issues: http://www.php.net/ChangeLog-7.php#7.1.2 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump version to 7.1.1Vicente Olivert Riera2017-01-231-1/+1
| | | | | | | | 0006-Fix-php-fpm.service.in.patch already included: https://github.com/php/php-src/commit/bb19125781c0794da9a63fee62e263ff4efff661 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump version to 7.1.0 (security)Vicente Olivert Riera2017-01-101-1/+1
| | | | | | | | | | | | | | | Fixed CVEs: - CVE-2016-9933 (imagefilltoborder stackoverflow on truecolor images) http://bugs.php.net/72696 - CVE-2016-9934 (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow) http://bugs.php.net/73331 Full ChangeLog: http://php.net/ChangeLog-7.php#7.1.0 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: add apache supportFabrice Fontaine2016-12-121-0/+10
| | | | | | | | | Continue work started by Bernd Kuhls in https://patchwork.ozlabs.org/patch/437544/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump to version 7.0.14Gustavo Zacarias2016-12-091-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: bump version to 7.0.13Vicente Olivert Riera2016-11-111-1/+1
| | | | | | | Release notes: http://php.net/ChangeLog-7.php#7.0.13 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: rework selection of interfacesFabrice Fontaine2016-10-241-4/+4
| | | | | | | | | | | | | | | | | | Following suggestion of Yann Morin, rework selection of php interfaces: use booleans instead of choice to be able to select multiple interfaces as they are not exclusive. We make sure at least one of the options is selected. It should be noted that previously CGI and FPM could not be selected at the same time. This is now possible. Bug that prevented compilation of CGI and FPM binaries at the same time has been fixed since PHP 5.4 (https://github.com/php-build/php-build/issues/101). Legacy handling is added for the two options that are removed, and the appropriate new options are selected. Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump to version 7.0.12Gustavo Zacarias2016-10-141-1/+1
| | | | | | | | | | See http://www.php.net/ChangeLog-7.php#7.0.12 since there are no CVEs out yet. And drop upstream patch. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: set MySQL socket pathFloris Bos2016-09-181-0/+5
| | | | | | | | Set the PHP default MySQL socket path to match what the mysql package is using. Signed-off-by: Floris Bos <bos@je-eigen-domein.nl> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump to 7.0.11Tatsuyuki Ishi2016-09-171-1/+1
| | | | | Signed-off-by: Tatsuyuki Ishi <ishitatsuyuki@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: explicitly disable phpdbgTheo Debrouwere2016-09-081-0/+1
| | | | | | | | When building php, the package will also build/install phpdbg. This patch explicitly disables this behaviour. Signed-off-by: Theo Debrouwere <t.debrouwere@televic.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: switch from libmysqlclient to mysqlndFloris Bos2016-09-061-4/+2
| | | | | | | | | | | | | | | The Mysql Native Driver has been the default mysql driver since PHP 5.4, but buildroot was still using libmysqlclient. Mysqlnd has several advantages such as improved memory management and the more favorable PHP licensing terms. (can combine it with proprietary PHP extensions like Ioncube loader, while libmysqlclient requires commercial licensing if you link to it and do not fall under their GPL/FOSS license exception) Signed-off-by: Floris Bos <bos@je-eigen-domein.nl> Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump version to 7.0.9Vicente Olivert Riera2016-07-211-1/+1
| | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: security bump version to 7.0.8Bernd Kuhls2016-06-261-1/+1
| | | | | | | | | | | | | | | Changelog is available here: http://php.net/ChangeLog-7.php#7.0.8 Fixes CVE-2015-8874 http://bugs.php.net/66387 Fixes CVE-2016-5766 http://bugs.php.net/72339 Fixes CVE-2016-5767 http://bugs.php.net/72446 Fixes CVE-2016-5768 http://bugs.php.net/72402 Fixes CVE-2016-5769 http://bugs.php.net/72455 Fixes CVE-2016-5772 http://bugs.php.net/72340 Fixes CVE-2016-5773 http://bugs.php.net/72434 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/php: fix date.timezoneYann E. MORIN2016-06-121-1/+2
| | | | | | | | | | | | | | | | In 5f37843a (php.ini: set date.timezone), the configured timezone was used as the default for PHP. However, BR2_TARGET_LOCALTIME is a string, so is quoted, so it is never empty, so the check for emptynessnever matches. Fix that by q-stripping the value before testing it. Note however that we do not q-strip it before storing it in the php.ini file, because it has to be q-stripped in there. Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Floris Bos <bos@je-eigen-domein.nl> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump version to 7.0.7Vicente Olivert Riera2016-06-011-1/+1
| | | | | | | | Fixes CVE-2013-7456 https://bugs.php.net/bug.php?id=72227 Fixes CVE-2016-5093 https://bugs.php.net/bug.php?id=72241 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump version to 7.0.6Vicente Olivert Riera2016-05-311-6/+2
| | | | | | | | | | | | | Remove MySQL legacy extension. Remove incompatible external modules: - php-gnupg - php-memcached - php-ssh2 - php-yaml Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: security bump to version 5.6.21Gustavo Zacarias2016-04-291-1/+1
| | | | | | | | | | | | Fixes (CVEs not assigned yet): bug #72094 - Out of bounds heap read access in exif header processing bug #71912 - libgd: signedness vulnerability bug #72061 - Out-of-bounds reads in zif_grapheme_stripos with negative offset bug #71843 - null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER bug #71952 - Corruption inside imageaffinematrixget Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: security bump to version 5.6.20Gustavo Zacarias2016-04-021-1/+1
| | | | | | | | | | | | Fixes (no CVEs yet): Buffer over-write in finfo_open with malformed magic file. Invalid memory write in phar on filename with \0 in name. Parsing of tar file with duplicate filenames causes memory leak. php_snmp_error() Format String Vulnerability. Integer Overflow in php_raw_url_encode. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: bump to version 5.6.19Gustavo Zacarias2016-03-041-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: security bump version to 5.6.18Bernd Kuhls2016-02-051-1/+1
| | | | | | | Changelog: http://www.php.net/ChangeLog-5.php#5.6.18 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* php: drop useless PHP_VERSION_MAJOR variableJerzy Grzegorek2016-01-291-2/+1
| | | | | | | | | ~/buildroot$ grep -R PHP_VERSION_MAJOR . ./package/php/php.mk:PHP_VERSION_MAJOR = 5.6 ./package/php/php.mk:PHP_VERSION = $(PHP_VERSION_MAJOR).17 Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* php: security bump to version 5.6.17Gustavo Zacarias2016-01-081-1/+1
| | | | | | | | | | | | | | | | Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). Bug #70755 (fpm_log.c memory leak and buffer overflow). Bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization). Bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability). Bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()). No CVEs assigned yet. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
OpenPOWER on IntegriCloud