03 September 2007, 13:20

PHP 5.2.4 - more stability, fewer flaws

In addition to fixing numerous flaws that affect the software's stability, in version 5.2.4 of the PHP scripting language the developers have closed a few supposedly non-critical security holes. The programmers say they have remedied more than 120 flaws in all.

Among other things, in previous versions it was possible to get around the restrictions imposed by open_basedir in the function glob() or in the session extension if the session file was a symbolic link. In addition, integer overflows could occur in the GD extension. The PCRE component included in the package to process regular expressions has also been updated to version 7.2.

PHP security specialist Stefan Esser reports that the developers have closed a denial-of-service (DoS) hole. In version 5.2.2 of PHP, the maximum depth of arrays was set to 64 to remedy a flaw made public during the Month of PHP Bugs. This step not only affected the HTTP methods POST and GET, but also cookies. Esser says that some web browsers may have stored cookies for top level domains, resulting in error pages or empty websites shown if vulnerable PHP installations generated the websites in that domain.

Several holes were apparently only exploitable in combination with other vulnerabilities. The new release's change log provides a complete list of the changes. The developers of PHP advise all PHP users upgrade to version 5.2.4, which is available for downloading at the project's website.