PHP 5.3.9

January 12th, 2012 | by Guillaume Plessis |

On january 10th 2012, the PHP group has released PHP 5.3.9, that brings over 90 bug fixes, some of which are security related :

Security Enhancements and Fixes in PHP 5.3.9:

  • Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885)
  • Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566)

Key enhancements in PHP 5.3.9 include:

  • Fixed bug #55475 (is_a() triggers autoloader, new optional 3rd argument to is_a and is_subclass_of).
  • Fixed bug #55609 (mysqlnd cannot be built shared)
  • Many changes to the FPM SAPI module

PHP 5.3.9 is now available on Dotdeb for :

  • both Debian 6.0 “Squeeze” and Debian 5.0 “Lenny”
  • both amd64 and i386 architectures

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

[edit] the packages have been updated to fix some Suhosin- and strtotime()-related issues. You really should upgrade at least :

  • to 5.3.9-0~dotdeb.3 if you’re running Squeeze
  • to 5.3.9-0~dotdeb.2 if you’re running Lenny

Tags: , ,

  1. 67 Responses to “PHP 5.3.9”

  2. By Kubofonista on Jan 12, 2012 | Reply

    Mhm, looks like WordPress crashing after this update (blank screen and HTTP 500)

  3. By Matic on Jan 12, 2012 | Reply

    I also have one application that is crashing since the upgrade to 5.3.9 and my friend reproduced it on another VM, but same software.

  4. By Dave on Jan 12, 2012 | Reply

    i have the same problem. php crash if i use:
    strtotime(“2012-01-12 21:13:28 UTC”)

  5. By Matic on Jan 12, 2012 | Reply

    @Dave
    Replicated on my crashing system.

    Interactive shell
    php > strtotime(’2012-01-12 21:13:28 UTC’);
    Crashes with: Segmentation fault

  6. By Guillaume Plessis on Jan 12, 2012 | Reply

    @Matic : I’ll release a fix in a few hours.

  7. By mptsnj on Jan 13, 2012 | Reply

    I know this doesn’t help the people running this service but just stating here for the users:

    I also have problems with this specific version and I didn’t yet find anything useful in the logs.. rolled back to 5.3.8-1~dotdeb.2 until I have some time to look into this

  8. By Guillaume Plessis on Jan 13, 2012 | Reply

    @mptsnj : an update (5.3.9-0~dotdeb.3 for Squeeze and 5.3.9-0~dotdeb.2 for Lenny) is coming. Please upgrade as soon as it’s available, the problem will be fixed.

  9. By Matic on Jan 13, 2012 | Reply

    The update solved the problem. My application is working now.

    @Guillaume Plessis, what was the cause of the segmentation fault? What can we learn from this?

    On a related note, my suhosin.ini file still gets overwritten everytime I update PHP packages, could the file be added to the list of config files in php5-suhosin debian package so it asks before overwriting?

  10. By Guillaume Plessis on Jan 13, 2012 | Reply

    @Matic : a patch that fixed a strtotime() memory leak before PHP 5.3.9 was no longer necessary and – worse – led to segfaults.

  11. By mptsnj on Jan 13, 2012 | Reply

    @Guillaume Plessis yep everything works as desired now … tanks for the ultra-fast response/update :)

  12. By Scott on Jan 13, 2012 | Reply

    Uhh I got a question about these packages and the mirrors.

    At least for my mirror I host for dotdeb the lenny packages don’t seem to be there. All I see is 5.2.17-0.dotdeb.0 still. And yes I made sure the rsync ran.

  13. By Scott on Jan 13, 2012 | Reply

    Actually I think you did this by design.

    I do have some clients that can’t use 5.3 yet and my accounting/billing software can’t use 5.3 just yet. So better to not put it in the main repo just yet.

  14. By Guillaume Plessis on Jan 13, 2012 | Reply

    @Scott : packages.dotdeb.org contains :
    * PHP 5.3.9 packages for Squeeze
    * PHP 5.2.17 packages for Lenny

    Packages of PHP 5.3.9 for Lenny are on php53.dotdeb.org (that has its own “php53″ module on rsync.dotdeb.org)

  15. By Jools on Jan 13, 2012 | Reply

    any chance you could put 5.3.8 back online please. thought it would be on your repository but it doesn’t seem to be :/

  16. By Guillaume Plessis on Jan 13, 2012 | Reply

    @Jools : http://archives.dotdeb.org/

  17. By Scott on Jan 13, 2012 | Reply

    Gui you want to add my php53 mirror on the site ?

  18. By Scott on Jan 13, 2012 | Reply

    Gui can you get on skype for a few minutes ?

  19. By Laph on Jan 13, 2012 | Reply

    Hint:
    If you’re using php5-fpm and another File extension than .php, add “security.limit_extensions = no” to all your fpm pool (!) definitions, or files with extensions other than .php will no be parsed and you’ll see just a “Access Denied” as output.

    I really dislike changes of this kind in a minor release – and the lack of documentation also!

    *grrrr*

  20. By Guillaume Plessis on Jan 13, 2012 | Reply

    @Scott : about your php53 mirror. php53.dotdeb.org will no longer exist as soon as lenny security support is ended (next month). But I’ll add your php54 mirror as soon as it exists :)

    @Laph : yes, this is a misleading new setting. It is present in the Changelog, but not very explicitly. And also not documented yet. Feel free to contribute : https://edit.php.net/?project=PHP&perm=fr/install.fpm.configuration.php

  21. By jools on Jan 13, 2012 | Reply

    I thought I had posted this but now i cant see it, so in case i didnt – apc.ini is being overwritten still with new updates. when making pecl packages locally, it doesnt happen, so I assume your perl helper needs an upgrade or something.

  22. By Vasiliy Toporov on Jan 13, 2012 | Reply

    Is it ok? I see 5.3.9-1~dotdeb.2 in phpinfo,but repo is for Squeeze (stable). Upgrade packs just right now. My system is Ubuntu 11.10 64-bit.

  23. By Guillaume Plessis on Jan 13, 2012 | Reply

    @jools : this behavior will be fixed in future release.

    @Vasiliy Toporov : run “apt-get update && apt-get dist-upgrade”, then be sure to restart Apache or PHP-FPM.

  24. By Joe Siegrist on Jan 13, 2012 | Reply

    It appears that php5-fpm has lost all warnings from 5.3.8 to 5.3.9 in the dotdeb build.

    Verified that the warnings are not sent over the network on the fpm port. Example script that spits warnings in 5.3.8 and won’t in 5.3.9 (with E_ALL | E_STRICT ):

    <?php
    $a[a];

    Thanks for maintaining this!

  25. By Guillaume Plessis on Jan 13, 2012 | Reply

    @Joe Siegrist : partial syslog support has been implemented in FPM. It may have led to the warnings loss.

  26. By Anthony Somerset on Jan 15, 2012 | Reply

    Hi Guillaume

    i’ve noticed this bug on quite a few upgrades of php now

    whenever i update PHP and its plugins (like APC etc)

    all my configs in my plugins ini files get reset back to default

    eg i have custom APC settings and every update i have to manually backup and recopy the config settings back into place

    the upgrader asks about the fpm and cli php.ini files what i want to do but not the plugins, any chance of rectifying this?

  27. By jools on Jan 15, 2012 | Reply

    Anthony: See a few posts above

  28. By Kubofonista on Jan 16, 2012 | Reply

    Seems like in 5.3.9 is conflict between APC and WordPress. WordPress randomly serves HTTP 500 until APC has been disabled

  29. By radar on Jan 16, 2012 | Reply

    @Anthony: the same problems with ini files (apc/memcached). Debian Squeeze 64bit.

  30. By Anthony Somerset on Jan 16, 2012 | Reply

    @jools, thanks i missed that, its not strictly isolated to apc, i think a few of the plugins have issues but because APC is the only one i really tweak its the only one i noticed

  31. By Scott on Jan 16, 2012 | Reply

    Same thing with suhosin.ini — so what I did was chattr +i all my ini files, that will stop the over writing.

  32. By Kevin on Jan 17, 2012 | Reply

    php5-curl and several others are having dependency issues:

    php5-curl : Depends: php5-common (= 5.3.3-7+squeeze3) but 5.3.9-1~dotdeb.3 is going to be installed.
    E: Broken Packages

    On the other hand, installing libmysqlclient15-dev (required to build sphinx search engine is also broken).

    Any hints on this one? I have to install everything prior to enabling the dotdeb repos, but that way I lose updates on one of the two repos..

  33. By Pierre-Henry on Jan 17, 2012 | Reply

    Bonjour Guillaume,

    Pour ma part je reviens sur ce billet pour chercher pourquoi certains wordpress faisaient des pages blanches en code 200.

    A priori tous les wordpress qui étaient configuré avec un php_admin_value[memory_limit]=32M ont aléatoirement des crash de mémoire non disponible. Bizarrement tout allait bien en 5.3.8 je me demande si la v9 aurait pas des soucis de consommation de mémoire.
    J’ai tenté d’enlever APC mais sans succès.

    Autre point plus important, au moins une variable des fichiers de conf n’est plus prise en compte. Sur mes configs fpm chaque vhost a ses propres fichiers de logs et je m’étonnais de rien voir dedans concernant une éventuelle erreur.

    Je me suis rendu compte que depuis la mise à jour la valeur php_admin_value[error_log] dans le fichier de conf du vhost n’écrase plus la valeur déclarée dans le php5-fpm.conf.

    Je ne vois pas à quoi cela est du, j’ai tenté de la déclarer en php_value sans succès.
    Actuellement c’est l’entrée error_log = /var/log/php5-fpm.conf dans /etc/php5/fpm/php5-fpm.conf qui est pris en compte par tous les vhost.

    Une idée?

  34. By Scott on Jan 17, 2012 | Reply

    @Kevin I’m not having that issue on any server. It sound like somethingdidn’t upgrade like it should have. Have you tried reinstalling the 5.3 packages again ?

  35. By Rémi SAUVAT on Jan 18, 2012 | Reply

    There is still a bug with your package.
    This is related only to the /etc/init.d/php5-fpm file.

    On reload command the script send a SIGHUP instead of SIGUSR2 as documented in php-fmp. The current behavior kills the master process. This has been corrected in latest releases of php-fpm for debian sid and unstable as stated here http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645934

    It would be nice to have it corrected in dotdeb packages too.

  36. By Guillaume Plessis on Jan 18, 2012 | Reply

    @Rémi Sauvat : thanks for this report. I’ll fix this in the next update.

  37. By Rémi SAUVAT on Jan 18, 2012 | Reply

    @Guillaume Plessis : Thanks for the quick reply. I am waiting for the next update.

  38. By Guillaume Plessis on Jan 19, 2012 | Reply

    Those having problem with PHP 5.3.9 : could you please tell me if you did install and activate the suhosin extension (php5-suhosin package)?

  39. By Pierre-Henry on Jan 19, 2012 | Reply

    Yes I have php5-suhosin 5.3.9-1~dotdeb.3 installed and enabled with default config :

    ; configuration for php suhosin module
    extension=suhosin.so
    suhosin.executor.include.whitelist=”phar”

  40. By Scott on Jan 20, 2012 | Reply

    Same here. Is Suhosin the problem again?

  41. By Joe on Jan 22, 2012 | Reply

    Hi,

    Thanks for the update!
    Just wondering: what is the preferred approach for handling php.ini changes when one has customisations in the existing php.ini?

    Is it a case of using diff/merge? Or is there a better way?

    Thanks!

  42. By David Goodwin on Jan 23, 2012 | Reply

    We’re seeing config files in /etc/ also being overwritten (e.g. /etc/php5/conf.d/xcache.ini ). It’s quite annoying.

  43. By Guillaume Plessis on Jan 23, 2012 | Reply

    @David Goodwin : this behavior will be fixed in the next release

  44. By Scott on Jan 24, 2012 | Reply

    You can’t even guess how pissed off I am about all the ini’s getting written over.

    33 servers I have to fix because of this.

  45. By Jools on Jan 24, 2012 | Reply

    I still get crashes with php-fpm on this version. am using 5.4.8 for now. crashes occur regularl/yconstantly with small apc cache and with large apc cache, less often but enough to make it an issue.

    couldnt see any major issues on php bugtracker though which is strange. Also I am not using php5-suhosin module.

    Appreciate the efforts here though. I wonder if it might be a useful idea to have a dotdeb stable and testing or so, and push packages to testing first, and to stable later. might help upgrade woes. cheers

  46. By Jools on Jan 24, 2012 | Reply

    5.3.8 i meant of course.

  47. By Scott on Jan 24, 2012 | Reply

    +1 for a testing repo

  48. By Scott on Jan 24, 2012 | Reply

    A proposed-updates repo instead of a testing would be better.

  49. By Guillaume Plessis on Jan 24, 2012 | Reply

    @Scott & Jools : I’d really like to spend as much time as needed to make everyone’s good ideas real (such as yours). Dotdeb is getting more and more popular, I’m proud of that. But people always have more and more expectations and support requests, and no one is planning any major donation or sponsor.

    I’d just like people to keep in mind that Dotdeb is a one-person project. As a freelance worker, my time is getting precious. I’ll keep on focusing on the existing packages, on fixing them and so on, but I can’t afford spending too much time on it.

    I’ll do my best. I know you’ll understand.

  50. By Jools on Jan 24, 2012 | Reply

    guillaume – I totally understand your point. I have similar problems with “wants” on some of my projects.

    I am of course happy to contribute a small amount financially, but might be more useful if I could contribute patches etc. Maybe some sort of github style repo?

    we do understand and thanks.

    Funnily enough before you were managing nginx, I was maintaining my own packages and there must be others, so perhaps some “pooling” of skills could help?

  51. By Jools on Jan 24, 2012 | Reply

    donation made. To add: I already have some changes I could commit to nginx packages if on a public repo, such as more types for the default mime types, and scripts to enable/disable sites like a2dissite etc (which I believe has been in older debian builds).

    If it already is somewhere apologies, and ill go and submit some diffs.

  52. By Guillaume Plessis on Jan 24, 2012 | Reply

    @Jools : thanks for the donation. I’m thinking of your suggestions : an “incoming” repo and a public repository. Stay tuned :)

  53. By Scott on Jan 24, 2012 | Reply

    I’ll make a nice size donation by Friday to you.

  54. By JD on Jan 25, 2012 | Reply

    By Guillaume Plessis on Jan 13, 2012 | Reply

    @Joe Siegrist : partial syslog support has been implemented in FPM. It may have led to the warnings loss.

    Can you please tell me what config setting controls this? I have lost all warnings like simple syntax errors in my lightttpd error.log
    btw i kept the old config from 5.3.8

  55. By Guillaume Plessis on Jan 25, 2012 | Reply

    @JD : as mentioned in the new configuration file the error logging directives are : error_log, syslog.facility, syslog.ident and log_level.

    Be also sure to set the appropriate error_reporting level in your scripts and that your worker has the permissions to write into your log files if you’ve overwritten the error_log directive for each of your process pools.

  56. By Dr.Diesel on Jan 25, 2012 | Reply

    Hello,

    @Jools : http://archives.dotdeb.org/

    php5-apc 5.3.8 package is missing

  57. By Guillaume Plessis on Jan 25, 2012 | Reply

    @Dr.Diesel :
    http://archives.dotdeb.org/dists/squeeze/php5-pecl/5.3.8/binary-amd64/php5-apc_5.3.8-1~dotdeb.2_amd64.deb
    http://archives.dotdeb.org/dists/squeeze/php5-pecl/5.3.8/binary-i386/php5-apc_5.3.8-1~dotdeb.2_i386.deb

  58. By Gator on Jan 27, 2012 | Reply

    Thanks for the up to date packages! As mentioned, a public repository on Github would be the next great step.

  59. By Free on Jan 27, 2012 | Reply

    Hello guys.

    Could you please disalbe posix in your builds?

    # php -m | grep posix
    posix
    #
    # php –version
    PHP 5.3.8-1~dotdeb.2 with Suhosin-Patch (cli) (built: Aug 25 2011 13:30:46)
    Copyright (c) 1997-2011 The PHP Group
    Zend Engine v2.3.0, Copyright (c) 1998-2011 Zend Technologies
    with the ionCube PHP Loader v4.0.7, Copyright (c) 2002-2011, by ionCube Ltd.
    with Suhosin v0.9.32.1, Copyright (c) 2007-2010, by SektionEins GmbH

  60. By Jools on Jan 27, 2012 | Reply

    Free: Why ?

  61. By Free on Jan 27, 2012 | Reply

    http://php.net/manual/en/intro.posix.php

    “Sensitive data can be retrieved with the POSIX functions, e.g. posix_getpwnam() and friends. None of the POSIX function perform any kind of access checking when safe mode is enabled. It’s therefore strongly advised to disable the POSIX extension at all (use –disable-posix in your configure line) if you’re operating in such an environment.”

  62. By Guillaume Plessis on Jan 27, 2012 | Reply

    @Free : Sorry, but posix won’t be disabled, it brings a lot of useful functions, while safe_mode is not a reliable security protection.

  63. By Jools on Jan 27, 2012 | Reply

    @Free: surely you can just disable the functions you dont want with suhosin for example?

    removing the posix functions would remove functionality from those who need them. debian for example also ships with them enabled.

  64. By Guillaume Plessis on Jan 27, 2012 | Reply

    @Free : Jools is right. You can deny the access to the posix functions using the disable_functions configuration variable in your php.ini.

    http://www.php.net/manual/en/ini.core.php#ini.disable-functions

  65. By Stéphane Cottin on Jan 31, 2012 | Reply

    Hi,

    https://bugs.php.net/bug.php?id=55475 breaks a LOT of websites

    plz apply the following workaround in php-pear package:

    — /usr/share/php/PEAR.old.php 2012-01-31 21:15:00.000000000 +0000
    +++ /usr/share/php/PEAR.php 2012-01-31 20:53:13.000000000 +0000
    @@ -249,7 +249,7 @@
    */
    function isError($data, $code = null)
    {
    - if (!is_a($data, ‘PEAR_Error’)) {
    + if (!is_object($data) || !is_a($data, ‘PEAR_Error’)) {
    return false;
    }

    thx

  66. By Guillaume Plessis on Feb 2, 2012 | Reply

    @Stéphane Cottin : I won’t/can’t fix this in the debian packaging script, because PEAR is released in a binary (phar) format.

    This bug has been fixed in pear-core and should be included in the next PHP releases : https://github.com/pear/pear-core/pull/3

  67. By Scott on Feb 3, 2012 | Reply

    @Stéphane That should be reported upstream to Debian instead of here so that the Debian team and can send out a update.

  68. By Stéphane Cottin on Feb 5, 2012 | Reply

    @Scott official debian php5 versions are 5.2 for lenny and 5.3.3 for squeeze , these version does not have this bug.

    @Guillaume hope the next package update will include the upstream fix, thx.

Post a Comment