PHP developers released updates to the 5.4 and 5.3 branches of the language.
The updates fix two security vulnerabilities and more than 30 other bugs. Developers patched a vulnerability in the DES implementation of the language’s crypt() function as has a heap overflow in PHP’s phar extension. Click here for details of the additional bug fixes.
Users can download PHP 5.4.4 and 5.3.14 in source form or as pre-compiled Windows binaries from the project’s web site.
Early last month, a remote-code execution vulnerability in PHP accidentally ended up released, leading to fears of an outbreak of attacks on sites built using vulnerable versions.
A team of researchers discovered the bug in January and reported it to the PHP Group. The developers were still in the process of building the patch for the flaw when it released.
The vulnerability is a simple one but it has serious consequences. Essentially, the researchers found when they passed a specific query string that contained the -s command to PHP in a CGI setup, PHP would interpret the -s as the command line argument and result in the disclosure of the source code for the application. They extended their testing and found they could pass whatever command-line arguments they wanted to the PHP binary.
PHP is a popular scripting language used in Web development. Since the time the team reported the bug to the PHP Group, there have been several new versions of the language released, with various other security fixes.