PHP Security Fixes: CVE-2007-1001, Header Injection, Buffer Overflows

Critical Vulnerability Information Security Enhancements and Fixes CVE-2007-1001: Fixed GD wbmp issue with invalid image size (Ivan Fratric) Header Injection Vulnerability: Fixed header injection in mail() function via Subject and To parameters (Stefan Esser) asciiz Byte Truncation: Fixed asciiz byte truncation within mail() (Stefan Esser) Length Calculation Error: Fixed length calculation error in unserialize S type (Stefan Esser) Bug in mb_parse_str(): Fixed bug that could lead to activation of register globals (Stefan Esser) Unallocated Memory Access: Fixed unallocated memory access/double free issue in array_user_key_compare() (Stefan Esser) Double Free: Fixed double free issue in session_regenerate_id() (Stefan Esser) Security Mode Checks: Added missing open_basedir and safe_mode checks in zip:// and bzip:// wrappers (Stefan Esser) Information Disclosure: Fixed information disclosure issues in substr_compare and substr_count (Stas, Ilia) Input Variable Nesting Limit: Introduced max_input_nesting_level to limit nesting level of input variables (Stefan Esser) CRLF Injection: Fixed CRLF injection in ftp_putcmd() (Bug.Center.Team) Super Global Overwrite: Fixed potential super global overwrite issue (Stefano Di Paola, Stefan Esser) Remote-Triggered Buffer Overflow: Fixed remote-triggered buffer overflow in make_http_soap_request() (Ilia Alshanetsky) Buffer Overflow: Fixed buffer overflow in user_filter_factory_create() (Ilia Alshanetsky) Remote-Triggered Buffer Overflow: Fixed remote-triggered buffer overflow in bundled libxmlrpc library (Stanislav Malyshev) Other Important Improvements Further improved memory manager to enhance realloc() performance Upgraded bundled GD, SQLite, and PCRE libraries Added methods related to SPL's DirectoryIterator and SplFileInfo classes Over 120 bug fixes Notes Most of the above issues are local, but may be externally triggered under certain specific code paths. It is strongly recommended to upgrade PHP.

Goal Reached Thanks to every supporter — we hit 100%!

PHP Security Fixes: CVE-2007-1001, Header Injection, Buffer Overflows