Security on Dotdeb

Dotdeb is shutting down on Dec 31st, 2026

Sat, 31 Oct 2026 12:00:00 +0000

No new packages have been published here for years. I still kept the repositories online, because pulling them would have broken every old server that still has Dotdeb in its sources.list.

The PHP2Shell vulnerabilities changed my mind: Every PHP package served from Dotdeb is affected, none of them will ever be fixed, and installing them today means putting a remotely exploitable server on the Internet. At this point, they’re basically malware, and it would not be responsible to keep serving them.

PHP 5.6.40 for Wheezy

Sat, 12 Jan 2019 21:36:14 +0000

On January 10th 2019, the PHP group released PHP 5.6.40.

The PHP development team announces the immediate availability of PHP 5.6.40. This is a security release. Several security bugs have been fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

Please note that according to the PHP version support timelines, PHP 5.6.40 is the last scheduled release of PHP 5.6 branch. There may be additional release if we discover important security issues that warrant it, otherwise this release will be the final one in the PHP 5.6 branch. If your PHP installation is based on PHP 5.6, it may be a good time to start making the plans for the upgrade to PHP 7.1, PHP 7.2 or PHP 7.3.

PHP 7.0.33 for Jessie

Sat, 08 Dec 2018 06:48:34 +0000

On December 6th 2018, the PHP group published PHP 7.0.33.

The PHP development team announces the immediate availability of PHP 7.0.33. Five security-related issues were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Please note that according to the PHP version support timelines, PHP 7.0.33 is the last scheduled release of PHP 7.0 branch. There may be additional release if we discover important security issues that warrant it, otherwise this release will be the final one in the PHP 7.0 branch. If your PHP installation is based on PHP 7.0, it may be a good time to start making the plans for the upgrade to PHP 7.1, PHP 7.2 or PHP 7.3.

PHP 5.6.39 for Wheezy

Sat, 08 Dec 2018 01:51:21 +0000

On December 6th 2018, the PHP group released PHP 5.6.39.

The PHP development team announces the immediate availability of PHP 5.6.39. This is a security release. Several security bugs have been fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

Please note that according to the PHP version support timelines, PHP 5.6.39 is the last scheduled release of PHP 5.6 branch. There may be additional release if we discover important security issues that warrant it, otherwise this release will be the final one in the PHP 5.6 branch. If your PHP installation is based on PHP 5.6, it may be a good time to start making the plans for the upgrade to PHP 7.1, PHP 7.2 or PHP 7.3.

Nginx 1.14.1 for Jessie

Mon, 12 Nov 2018 17:55:16 +0000

Nginx 1.14 has been released on April 17th 2018, incorporating new features and bug fixes from the 1.13.x mainline branch - including the mirror module, HTTP/2 push, the gRPC proxy module, and more..

Nginx 1.14.1 has then been released on November 6th, 2018, with fixes for vulnerabilities in HTTP/2 (CVE-2018-16843, CVE-2018-16844) and the MP4 module (CVE-2018-16845)..

As a consequence, packages of Nginx 1.14.1 are now available for Debian 8 “Jessie” (with or without full HTTP2 support - see the instructions), on both amd64 and i386 architectures. Associated modules have been updated too. Please note that PageSpeed is now only supported on amd64, not i386.

PHP 7.0.32 for Jessie

Wed, 19 Sep 2018 09:53:07 +0000

On September 13th 2018, the PHP group published PHP 7.0.32.

This is a security release. One security bug has been fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.32 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug.

Important reminder: Jessie entered its “Long Term Support” phase in June 2018 and PHP 7.0 will reach its “End Of Life” in December of this year. Please consider upgrading to more recent versions of both Debian and PHP.

PHP 5.6.38 for Wheezy

Wed, 19 Sep 2018 09:50:36 +0000

On September 13th 2018, the PHP group released PHP 5.6.38.

This is a security release. One security bug has been fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.38 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

Important reminder: Wheezy is “End Of Life” since May 2018 and PHP 5.6 will at the end of this year. These packages are provided for legacy servers. Please consider upgrading to more recent versions of both Debian and PHP.

PHP 7.0.31 for Jessie

Sun, 22 Jul 2018 21:00:30 +0000

On July 19th 2018, the PHP group published PHP 7.0.31.

This is a security release. Several security bugs have been fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.31 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug.

PHP 5.6.37 for Wheezy

Sun, 22 Jul 2018 20:52:47 +0000

On July 20th 2018, the PHP group released PHP 5.6.37.

This is a security release. Several security bugs have been fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.37 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 5.6.36 for Wheezy

Sat, 28 Apr 2018 00:57:39 +0000

On April 26th 2018, the PHP group released PHP 5.6.36.

This is a security release. Several security bugs have been fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.36 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.30 for Jessie

Thu, 26 Apr 2018 18:50:45 +0000

On April 26th 2018, the PHP group published PHP 7.0.30.

This is a security release. Several security bugs have been fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.30 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug.

PHP 5.6.35 for Wheezy

Sun, 01 Apr 2018 09:57:15 +0000

On March 29th 2018, the PHP group released PHP 5.6.35.

This is a security release. One security bug was fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.35 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.29 for Jessie

Sat, 31 Mar 2018 13:57:17 +0000

On March 29th 2018, the PHP group published PHP 7.0.29.

This is a security release. One security bug was fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.29 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug.

PHP 7.0.28 for Jessie

Tue, 13 Mar 2018 09:26:39 +0000

On March 1st 2018, the PHP group published PHP 7.0.28.

This is a security release. One security bug was fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.28 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug.

PHP 5.6.34 for Wheezy

Mon, 12 Mar 2018 20:06:29 +0000

On March 1st 2018, the PHP group released PHP 5.6.34.

This is a security release. One security bug was fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.34 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 5.6.33 for Wheezy

Fri, 05 Jan 2018 22:50:56 +0000

On January 4th 2018, the PHP group released PHP 5.6.33.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.33 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.27 for Jessie

Thu, 04 Jan 2018 22:18:06 +0000

On January 4th 2018, the PHP group published PHP 7.0.27.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

This release marks the end of the two years active support period for the 7.0 branch. The further releases of the 7.0 branch will be issued on demand and contain only critical security relevant bug fixes. The security support is provided till December 3rd, 2018. It is a good time to plan the migration to PHP 7.1 or 7.2.

PHP 5.6.32 for Wheezy

Fri, 03 Nov 2017 01:07:12 +0000

On October 26th 2017, the PHP group released PHP 5.6.32.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.32 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.25 for Jessie

Thu, 02 Nov 2017 17:36:33 +0000

On October 26th 2017, the PHP group published PHP 7.0.25.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.25 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug.

Nginx 1.12.1 for Jessie

Thu, 20 Jul 2017 15:46:21 +0000

Nginx 1.12 has been released on April 12th 2017, bringing a number of new features and capabilities to the 1.11 mainline branch: dynamic modules, IP Transparency, improved TCP/UDP load balancing, better caching performance, and more. You will find more details on this blog post.

Nginx 1.12.1 has then been released on July 12th, 2017 to fix an integer overflow in the range filter (CVE-2017-7529).

As a consequence, packages of Nginx 1.12.1 are now available for Debian 8 “Jessie” (with or without full HTTP2 support - see the instructions), on both amd64 and i386 architectures.

PHP 5.6.31 for Wheezy

Fri, 14 Jul 2017 18:33:48 +0000

On July 6th 2017, the PHP group released PHP 5.6.31.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.31 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

Redis 3.2.8

Wed, 15 Feb 2017 20:17:55 +0000

Redis 3.2.7 has been released on January 31st 2017 to fix important security and correctness issues.

It is especially important to upgrade for Redis Cluster users and for users running Redis in their laptop since a cross-scripting attack is fixed in this release…

Then Redis 3.2.8 has been released on February 12th 2017 to fix potential deadlocks with Redis 3.2.7 and a crash after a socket error.

In both cases, the upgrade urgency is high.

PHP 7.0.15 for Jessie

Sat, 21 Jan 2017 21:16:58 +0000

On January 19th 2017, the PHP group published PHP 7.0.15.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.15 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug.

I’ll detail the plan for PHP 7.1 in a future post.

PHP 5.6.30 for Wheezy

Sat, 21 Jan 2017 21:15:05 +0000

On January 19th 2017, the PHP group released PHP 5.6.30.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

According to our release calendar, this PHP 5.6 version is the last planned release that contains regular bugfixes. All the consequent releases will contain only security-relevant fixes, for the term of two years. PHP 5.6 users that need further bugfixes are encouraged to upgrade to PHP 7.

PHP 7.0.14 for Jessie

Mon, 12 Dec 2016 20:18:29 +0000

On December 8th 2016, the PHP group published PHP 7.0.14.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.14 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug (Careful, PHP 7 support from some of them is still very young!).

PHP 5.6.29 for Wheezy

Mon, 12 Dec 2016 20:16:20 +0000

On December 8th 2016, the PHP group released PHP 5.6.29.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.29 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 5.6.28 for Wheezy

Sat, 12 Nov 2016 21:42:06 +0000

On November 10th 2016, the PHP group released PHP 5.6.28.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.28 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.13 for Jessie

Thu, 10 Nov 2016 19:34:16 +0000

On November 10th 2016, the PHP group published PHP 7.0.13.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.13 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug (Careful, PHP 7 support from some of them is still very young!).

Update : Nginx 1.10.2

Thu, 27 Oct 2016 20:14:03 +0000

Packages of Nginx 1.10.2 for Jessie and Wheezy - amd64 and i386 - have been updated to fix CVE 2016-1247.

Secure log file handling (owner & permissions) against privilege escalation attacks. /var/log/nginx is now owned by root:adm. Thanks Dawid Golunski for the report. Changing /var/log/nginx permissions effectively reopens #701112, since log files can be world-readable. This is a trade-off until a better log opening solution is implemented upstream ( trac:376).

This update can also bring full HTTP2 support to Jessie with a new additional repository. As a reminder, Chrome as a browser was not supported on stock Jessie, because it requires a more recent OpenSSL 1.0.2 for its ALPN protocol. Now that jessie-backports includes such an OpenSSL version, Dotdeb provides Nginx packages with full HTTP2 support for Chrome. Here is how to install them :

PHP 7.0.12 for Jessie

Mon, 17 Oct 2016 18:13:10 +0000

On October 13th 2016, the PHP group published PHP 7.0.12.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.12 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug (Careful, PHP 7 support from some of them is still very young!).

PHP 5.6.27 for Wheezy

Mon, 17 Oct 2016 18:11:28 +0000

On October 14th 2016, the PHP group released PHP 5.6.27.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.27 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

Redis 3.2.4

Wed, 28 Sep 2016 16:47:07 +0000

Redis 3.2.4 has been released on September 26th 2016, bringing an important security fix and a few other changes.

The upgrade urgency is critical.

The packages are now available :

for Debian 8 “Jessie” and Debian 7 “Wheezy”
on both amd64 and i386 architectures.

PHP 7.0.11 for Jessie

Mon, 19 Sep 2016 07:45:47 +0000

On September 15th 2016, the PHP group published PHP 7.0.11.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.11 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug (Careful, PHP 7 support from some of them is still very young!).

PHP 5.6.26 for Wheezy

Mon, 19 Sep 2016 07:44:11 +0000

On September 16th 2016, the PHP group released PHP 5.6.26.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.26 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.10 for Jessie

Fri, 19 Aug 2016 07:18:06 +0000

On August 18th 2016, the PHP group published PHP 7.0.10.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.10 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug (Careful, PHP 7 support from some of them is still very young!).

PHP 5.6.25 for Wheezy

Fri, 19 Aug 2016 06:03:58 +0000

On August 18th 2016, the PHP group released PHP 5.6.25.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.25 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

Redis 3.2.3

Fri, 05 Aug 2016 00:55:19 +0000

Redis 3.2.3 has been released on August 2nd 2016, bringing fixes for replication delay and for a redis-cli security issue.

The upgrade urgency moderate.

The packages are now available :

for Debian 8 “Jessie” and Debian 7 “Wheezy”
on both amd64 and i386 architectures.

PHP 7.0.9 for Jessie

Fri, 22 Jul 2016 07:28:47 +0000

On July 21st 2016, the PHP group published PHP 7.0.9.

This is a security release. Several security bugs were fixed in this release, including the HTTP_PROXY issue. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.9 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug (Careful, PHP 7 support from some of them is still very young!).

PHP 5.6.24 for Wheezy

Fri, 22 Jul 2016 07:26:50 +0000

On July 21st 2016, the PHP group released PHP 5.6.24.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.24 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 5.5.38 for Wheezy (End of Life)

Fri, 22 Jul 2016 07:22:14 +0000

On July 21st 2016, the PHP group released PHP 5.5.38.

This is a security release that fixes some security related bugs. All PHP 5.5 users are encouraged to upgrade to this version. (…) Note that according to our release schedule, PHP 5.5.38 is the last release of the PHP 5.5 branch. There may be additional release if we discover important security issues that warrant it, otherwise this release will be the final one in the PHP 5.5 branch. If your PHP installation is based on PHP 5.5, it may be a good time to start making the plans for the upgrade to PHP 5.6 or PHP 7.0.

PHP 7.0.8 for Jessie

Fri, 24 Jun 2016 18:14:17 +0000

On June 23rd 2016, the PHP group published PHP 7.0.8.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Please also note that bcmatch, dba, mbstring, soap, xml and zip now have their separate dedicated packages.

Packages of PHP 7.0.8 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis, ssh2 and xdebug (Careful, PHP 7 support from some of them is still very young!).

PHP 5.6.23 for Wheezy

Fri, 24 Jun 2016 17:53:51 +0000

On June 23rd 2016, the PHP group released PHP 5.6.23.

Several bugs were fixed in this release, including security-related ones. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.23 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 5.5.37 for Wheezy

Fri, 24 Jun 2016 17:44:48 +0000

On June 23rd 2016, the PHP group released PHP 5.5.37.

This is a security release, several security bugs were fixed. All PHP 5.5 users are encouraged to upgrade to this version.

And because it’s probably the last PHP 5.5 release before it reaches its security EOL, you’d better upgrade to PHP 5.6 and above as soon as possible.

PHP 5.5.37 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

Nginx 1.10.1 for Jessie and Wheezy

Thu, 02 Jun 2016 01:30:31 +0000

Nginx 1.10 - the new stable major version - has been released on May 24th 2016, followed by Nginx 1.10.1 on May 31st to fix the CVE-2016-4450 vulnerability.

The 1.10 branch brings a lot of new features and improvements, including :

HTTP/2 support: The SPDY module was replaced by the HTTP/2 module. Please make sure to update your listen directives.
The new stream module that lets you proxy and load-balance UDP and TCP traffic.
Support for dynamic modules.
SO_REUSEPORT support, TCP support for DNS resolution…

PHP 7.0.7 for Jessie

Wed, 01 Jun 2016 14:28:57 +0000

On May 26th 2016, the PHP group published PHP 7.0.7.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.7 are now available for Debian 8 “Jessie” on amd64 and i386 architectures, along with the following PECL extensions : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis and debug (Careful, PHP 7 support from some of them is still very young!).

PHP 5.6.22 for Wheezy

Wed, 01 Jun 2016 14:25:33 +0000

On May 26th 2016, the PHP group released PHP 5.6.22.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.22 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 5.5.36 for Wheezy

Wed, 01 Jun 2016 14:23:13 +0000

On May 26th 2016, the PHP group released PHP 5.5.36.

This is a security release. Several security bugs were fixed in this release. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.36 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.11
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4

Please read the Changelog before upgrading.

PHP 5.6.21 for Wheezy

Fri, 29 Apr 2016 17:16:09 +0000

On April 29th 2016, the PHP group released PHP 5.6.21.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.21 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.6 for Jessie

Fri, 29 Apr 2016 17:06:58 +0000

On April 29th 2016, the PHP group published PHP 7.0.6.

This is a security release. Several security bugs were fixed in this release, including CVE-2016-3078 and CVE-2016-3074. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.6 are now available for Debian 8 “Jessie” on amd64 and i386 architectures.

Please note that :

PHP 7 and PHP 5 from Jessie are now co-installable on the same machine
Packages of the following PECL extensions are now available : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis and xdebug. Careful, PHP 7 support from some of them is still very young.
The thread-safe version of all these packages will be published soon.

As usual :

PHP 5.6.20 for Wheezy

Fri, 01 Apr 2016 07:40:14 +0000

On March 31st 2016, the PHP group released PHP 5.6.20.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.20 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.5 for Jessie

Fri, 01 Apr 2016 04:57:28 +0000

On March 31st 2016, the PHP group published PHP 7.0.5.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.5 are now available for Debian 8 “Jessie” on amd64 and i386 architectures.

Please note that :

PHP 7 and PHP 5 from Jessie are now co-installable on the same machine
Packages of the following PECL extensions are now available : APCu, APCu_bc, geoip, igbinary, imagick, memcached, mongodb, msgpack, redis and xdebug. Careful, PHP 7 support from some of them is still very young.
The thread-safe version of all these packages will be published soon.

As usual :

PHP 5.5.33 for Wheezy

Tue, 08 Mar 2016 07:10:33 +0000

On March 3rd 2016, the PHP group released PHP 5.5.33.

This is a security release in which two security bugs were fixed. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.33 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.11
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4

Please read the Changelog before upgrading.

PHP 5.6.19 for Wheezy

Sat, 05 Mar 2016 20:07:17 +0000

On March 3rd 2016, the PHP group released PHP 5.6.19.

This is a security release in which several security bugs were fixed. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.19 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.4 for Jessie

Fri, 04 Mar 2016 05:09:22 +0000

On March 3rd 2016, the PHP group published PHP 7.0.4.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.4 are now available for Debian 8 “Jessie” on amd64 and i386 architectures.

Please note that :

PHP 7 and PHP 5 from Jessie are now co-installable on the same machine
Packages of the following PECL extensions are now available : APCu, APCu_bc, igbinary, imagick, memcached, mongodb, msgpack, redis and xdebug. Careful, PHP 7 support from some of them is still very young.
the memcached.serializer is now igbinary by default. You should change it back to php if you’re upgrading from a previous version.
The thread-safe version of all these packages will be published soon.

As usual :

PHP 5.6.18 for Wheezy

Sun, 07 Feb 2016 20:22:07 +0000

On February 4th 2016, the PHP group released PHP 5.6.18.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.18 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 7.0.3 for Jessie

Fri, 05 Feb 2016 23:10:11 +0000

On February 4th 2016, the PHP group published PHP 7.0.3.

This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.3 are now available for Debian 8 “Jessie” on amd64 and i386 architectures.

Please note that :

PHP 7 and PHP 5 from Jessie are now co-installable on the same machine
Packages of the following PECL extensions are now available : APCu, APCu_bc, igbinary, imagick, memcached, mongodb, msgpack, redis and xdebug. Careful, PHP 7 support from some of them is still very young.
the memcached.serializer is now igbinary by default. You should change it back to php if you’re upgrading from a previous version.
The thread-safe version of all these packages will be published soon.

As usual :

Nginx 1.8.1

Tue, 26 Jan 2016 22:55:34 +0000

Nginx 1.8.1 has been released on January 26th 2016, to fix three security issues in its resolver.

As a consequence, packages of Nginx 1.8.1 are now available :

for Debian 8 “Jessie”, Debian 7 “Wheezy” and Debian 6 “Squeeze”
On both amd64 and i386 architectures.

Please also note that ngx_pagespeed has been updated to :

version 1.10.33.2 on Jessie
only version 1.9.32.11 on Wheezy and Squeeze, because the 1.10 branch now requires GCC 4.8+. Usage of ngx_pagespeed on Wheezy and Squeeze has been kept for compatibility purpose but is highly discouraged. Upgrade to Jessie instead.

For more details about which modules are included in the different Nginx flavors, just have to look at this document.

PHP 7.0.2 for Jessie

Fri, 08 Jan 2016 04:26:32 +0000

On January 7th 2016, the PHP group published PHP 7.0.2.

31 reported bugs has been fixed, including 6 security related issues. All PHP 7.0 users are encouraged to upgrade to this version.

Packages of PHP 7.0.2 are now available for Debian 8 “Jessie” on amd64 and i386 architectures.

Please note that :

You should remove any PHP5 packages before upgrading
Packages of the PECL extensions (Memcache, Memcached, Mongo, Redis, Xdebug…) are still missing.
The thread-safe version of all these packages will be published soon.

Please make sure that you understand the above PHP/Debian/Dotdeb changes and that you don’t need any of the missing features/packages. Your feedbacks are always welcome. Just make sure they are useful.

PHP 5.6.17 for Wheezy

Fri, 08 Jan 2016 04:20:51 +0000

On January 7th 2016, the PHP group released PHP 5.6.17.

This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.17 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 5.6.15 for Wheezy

Tue, 03 Nov 2015 19:14:54 +0000

On October 29th 2015, the PHP group released PHP 5.6.15.

Several bugs have been fixed. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.15 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

PHP 5.5.30 for Wheezy

Mon, 12 Oct 2015 02:42:05 +0000

On October 1st 2015, the PHP group released PHP 5.5.30.

This is a security release. Two security bugs were fixed in this release. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.30 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.11
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4

Please read the Changelog before upgrading.

PHP 5.6.14 for Wheezy

Fri, 02 Oct 2015 15:20:35 +0000

On October 1st 2015, the PHP group released PHP 5.6.14.

Two security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.14 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

Redis 3.0.4

Tue, 08 Sep 2015 15:12:02 +0000

Redis 3.0.4 has been released on September 8th 2015, bringing some important fixes and new replication features.

The upgrade urgency is high for Redis and Sentinel.

However note that in order to fix certain replication bugs, the replication internals were modified in a very heavy way. So while this release is conceptually saner, it may contain regressions. For this reason, before the release, QA activities were performed by me ( antirez) and Redis Labs and no evident bug was found.

Zabbix 2.2.10

Tue, 08 Sep 2015 02:06:44 +0000

Zabbix 2.2.10 has been released on August 10th 2015. This release fixes known issues of Zabbix 2.2.x and introduces new minor features. Please read the release notes for more info.

As usual, the packages are now available :

for Debian 7.0 “Wheezy and 6.0 “Squeeze”,
on both amd64 and i386 architectures.

PHP 5.4.45, for Wheezy and Squeeze

Tue, 08 Sep 2015 02:00:16 +0000

On September 4th 2015, the PHP group released PHP 5.4.45.

Ten security-related issues were fixed in this release. All PHP 5.4 users are encouraged to upgrade to this version.

(…)

Please note that according to the PHP version support timelines, PHP 5.4.45 is the last scheduled release of PHP 5.4 branch. There may be additional release if we discover important security issues that warrant it, otherwise this release will be the final one in the PHP 5.4 branch. If your PHP installation is based on PHP 5.4, it may be a good time to start making the plans for the upgrade to PHP 5.5 or PHP 5.6.

PHP 5.5.29 for Wheezy

Mon, 07 Sep 2015 19:00:34 +0000

On September 4th 2015, the PHP group released PHP 5.5.29.

This is a security release. Many security-related issues were fixed in this release. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.29 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.10
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4

Please read the Changelog before upgrading.

PHP 5.6.13 for Wheezy

Fri, 04 Sep 2015 22:48:23 +0000

On September 4th 2015, the PHP group released PHP 5.6.13.

11 security-related issues were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.13 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

Note : php5-memcached still lacks JSON support.

PHP 5.5.28 for Wheezy

Sun, 23 Aug 2015 05:51:04 +0000

On August 6th 2015, the PHP group released PHP 5.5.28.

12 security-related issues were fixed in this release. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.28 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.10
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4

Please read the Changelog before upgrading.

PHP 5.6.12 for Wheezy

Sat, 08 Aug 2015 23:49:28 +0000

On August 6th 2015, the PHP group released PHP 5.6.12.

12 security-related issues were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.12 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

Note : php5-memcached still lacks JSON support.

PHP 5.4.43, for Wheezy and Squeeze

Wed, 22 Jul 2015 23:22:38 +0000

On July 9th 2015, the PHP group released PHP 5.4.43.

Five security-related issues in PHP were fixed in this release, including CVE-2015-3152. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.7
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.10
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.3
xhprof 0.9.4
zendopcache 7.0.5

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.27 for Wheezy

Wed, 15 Jul 2015 18:23:22 +0000

On July 10th 2015, the PHP group released PHP 5.5.27.

Several bugs were fixed in this release as well as CVE-2015-3152. All PHP 5.5 users are encouraged to upgrade to this version. (…) this PHP 5.5 version is the last planned release that contains regular bugfixes. All the consequent releases will contain only security-relevant fixes, for the term of one year. PHP 5.5 users that need further bugfixes are encouraged to upgrade to PHP 5.6.

PHP 5.6.11 for Wheezy

Tue, 14 Jul 2015 05:52:34 +0000

On July 10th 2015, the PHP group released PHP 5.6.11.

Five security-related issues in PHP were fixed in this release, including CVE-2015-3152. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.11 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with the usual PECL extensions.

Note : php5-memcached still lacks JSON support.

MySQL 5.6.25 for Wheezy

Sat, 04 Jul 2015 20:33:23 +0000

MySQL 5.6.25 has been released by Oracle on May 29th 2015. Please read the full Changelog fore more details.

The corresponding packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

PHP 5.4.42, for Wheezy and Squeeze

Wed, 24 Jun 2015 05:40:56 +0000

On June 11th 2015, the PHP group released PHP 5.4.42.

Six security-related issues in PHP were fixed in this release, as well as several security issues in bundled sqlite library (CVE-2015-3414, CVE-2015-3415, CVE-2015-3416). All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

PHP 5.5.26 for Wheezy

Wed, 17 Jun 2015 06:35:38 +0000

On June 11th 2015, the PHP group released PHP 5.5.26.

Several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414, CVE-2015-3415, CVE-2015-3416, CVE-2015-2325 and CVE-2015-2326). All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.26 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.9
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4

Please note that the PCRE issue that Apache users encountered is now fixed.

PHP 5.6.10 for Wheezy

Fri, 12 Jun 2015 04:45:04 +0000

On June 11th 2015, the PHP group released PHP 5.6.10.

Several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414, CVE-2015-3415, CVE-2015-3416, CVE-2015-2325 and CVE-2015-2326). All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.10 packages are now available for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors, along with packages of Xdebug (yeah!), XHprof (yeah! x2) and other PECL extensions.

Redis 3.0.2

Thu, 04 Jun 2015 17:57:12 +0000

Redis 3.0.2 has been released on June 4th 2015, bringing security fixes, as well as new options and commands.

The upgrade urgency high for Redis because of a security issue, low for Sentinel.

The packages are now available :

for Debian 8 “Jessie”, Debian 7 “Wheezy” and Debian 6 “Squeeze”
on both amd64 and i386 architectures.

PHP 5.4.41, for Wheezy and Squeeze

Fri, 22 May 2015 14:32:33 +0000

On May 14th 2015, the PHP group released PHP 5.4.41.

Seven security-related issues were fixed in this version. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.7
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.8
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4
zendopcache 7.0.5

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.4.40, for Wheezy and Squeeze

Thu, 23 Apr 2015 03:41:52 +0000

On April 16th 2015, the PHP group released PHP 5.4.40.

14 security-related bugs were fixed in this release, including CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, CVE-2015-1352. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.7
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.6
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4
zendopcache 7.0.5

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.24 for Wheezy

Thu, 23 Apr 2015 01:15:19 +0000

On April 16th 2015, the PHP group released PHP 5.5.24.

Several bugs have been fixed some of them beeing security related, like CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.24 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.6
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

PHP 5.6.8 for Wheezy

Wed, 22 Apr 2015 07:03:09 +0000

On April 16th 2015, the PHP group released PHP 5.6.8.

Several bugs have been fixed some of them beeing security related, like CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.8 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors.

Notes :

Regression : php5-memcached still lacks JSON support
Xcache, Xdebug and Xhprof are currently being worked on and should be available in the next few days

Zabbix 2.2.9

Mon, 06 Apr 2015 17:58:34 +0000

Zabbix 2.2.9 has been released on March 12th 2015. This release fixes known issues of Zabbix 2.2.x and introduces new minor features. Please read the release notes for more info.

As usual, the packages are now available :

for Debian 7.0 “Wheezy and 6.0 “Squeeze”,
on both amd64 and i386 architectures.

PHP 5.4.39, for Wheezy and Squeeze

Sun, 22 Mar 2015 20:36:50 +0000

On March 19th 2015, the PHP group released PHP 5.4.39.

Six security-related bugs were fixed in this release, including CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.7
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.5
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4
zendopcache 7.0.4

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.23 for Wheezy

Sun, 22 Mar 2015 18:22:05 +0000

On March 20th 2015, the PHP group released PHP 5.5.23.

Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.23 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.5
pecl_http 1.7.6
pinba (master)
redis 2.2.7
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.2
xhprof 0.9.4

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

PHP 5.6.7 for Wheezy

Sun, 22 Mar 2015 15:55:47 +0000

On March 20th 2015, the PHP group released PHP 5.6.7.

Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.7 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors.

Notes :

Regression : php5-memcached still lacks JSON support
Missing packages : Xcache, Xdebug and Xhprof are still missing, I’m still working on it, sorry for the delay
End of support : Spplus won’t be supported anymore. Pinba’s fate hasn’t been decided yet.

PHP 5.4.38, for Wheezy and Squeeze

Sun, 01 Mar 2015 02:38:36 +0000

On February 18th 2015, the PHP group released PHP 5.4.38.

Seven security-related bugs were fixed in this release, including CVE-2015-0273 and mitigation for CVE-2015-0235. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.7
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.3
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.1
xhprof 0.9.4
zendopcache 7.0.4

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.22 for Wheezy

Thu, 26 Feb 2015 05:36:15 +0000

On February 19th 2015, the PHP group released PHP 5.5.22.

This release fixes several bugs and addresses CVE-2015-0235 and CVE-2015-0273. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.22 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.3
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.3.1
xhprof 0.9.4

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

PHP 5.6.6 for Wheezy

Sat, 21 Feb 2015 17:31:52 +0000

On February 19th 2015, the PHP group released PHP 5.6.6.

This release fixes several bugs and addresses CVE-2015-0235 and CVE-2015-0273. All PHP 5.6 users are encouraged to upgrade to this version. (…) The list of changes is recorded in the ChangeLog.

PHP 5.6.6 packages are now available on Dotdeb for Debian 7 “Wheezy”, on both amd64 and i386 architectures, in ZTS and non-ZTS (default) flavors.

Notes :

Regression : php5-memcached still lacks JSON support
Missing packages : Xcache, Xdebug and Xhprof are still missing, I’m working on it
End of support : Spplus won’t be supported anymore. Pinba’s fate hasn’t been decided yet.

PHP 5.4.37, for Wheezy and Squeeze

Fri, 06 Feb 2015 06:02:19 +0000

On January 22nd 2015, the PHP group released PHP 5.4.37.

Six security-related bugs were fixed in this release, including CVE-2015-0231, CVE-2014-9427 and CVE-2015-0232. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.7
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.1
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.2.7
xhprof 0.9.4
zendopcache 7.0.4

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.21 for Wheezy

Wed, 04 Feb 2015 06:20:09 +0000

On January 22nd 2015, the PHP group released PHP 5.5.21.

This release fixes several bugs as well as CVE-2015-0231, CVE-2014-9427 and CVE-2015-0232. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.21 packages are now available on Dotdeb for Debian 7.7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.6.0
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.2.7
xhprof 0.9.4

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

PHP 5.6.5 for Wheezy

Mon, 02 Feb 2015 01:54:15 +0000

On January 22nd 2015, the PHP group released PHP 5.6.5.

This release fixes several bugs as well as CVE-2015-0231, CVE-2014-9427 and CVE-2015-0232. All PHP 5.6 users are encouraged to upgrade to this version. (…) The list of changes is recorded in the ChangeLog.

PHP 5.6.5 packages are now available on Dotdeb for Debian 7.7 “Wheezy”, on both amd64 and i386 architectures.

Notes :

Because of performance issues with Zend thread safety (pthreads depends on it), I had to disable it on the wheezy-php56 repo. Users using pthreads now have to use the wheezy-php56-zts repository instead. See the instructions for more details
Regression : php5-memcached still lacks JSON support
Missing packages : Xcache, Xdebug and Xhprof are still missing, I’m working on it
End of support : Spplus won’t be supported anymore. Pinba’s fate hasn’t been decided yet.

Zabbix 2.2.8

Sun, 21 Dec 2014 00:03:56 +0000

Zabbix 2.2.8 has been released on December 15th 2014. This release fixes known issues of Zabbix 2.2.x. Please read the release notes for more info.

As usual, the packages are now available :

for Debian 7.0 “Wheezy and 6.0 “Squeeze”,
on both amd64 and i386 architectures.

PHP 5.4.36, for Wheezy and Squeeze

Sat, 20 Dec 2014 22:44:50 +0000

On December 18th 2014, the PHP group released PHP 5.4.36.

Two security-related bugs were fixed in this release, including the fix for CVE-2014-8142. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.7
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.5.8
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.2.6
xhprof 0.9.4
zendopcache 7.0.3

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.20 for Wheezy

Sat, 20 Dec 2014 21:45:42 +0000

On December 18th 2014, the PHP group released PHP 5.5.20.

This release fixes several bugs and one CVE related to unserialization. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.20 packages are now available on Dotdeb for Debian 7.7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.7
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.5.8
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.2.6
xhprof 0.9.4

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

PHP 5.6.4 for Wheezy

Sat, 20 Dec 2014 17:03:39 +0000

On December 18th 2014, the PHP group released PHP 5.6.4.

Two security-related bugs were fixed in this release, including the fix for CVE-2014-8142. All PHP 5.4 users are encouraged to upgrade to this version.

PHP 5.6.4 packages are now available on Dotdeb for Debian 7.7 “Wheezy”, on both amd64 and i386 architectures.

Please also note these points :

Regression : php5-memcached lacks JSON support
Missing packages : Xcachen Xdebug and Xhprof are missing for now
End of support : Spplus won’t be supported anymore. Pinba’s fates hasn’t been decided yet.

As a consequence :

PHP 5.4.35, for Wheezy and Squeeze

Tue, 18 Nov 2014 23:39:18 +0000

On November 13th 2014, the PHP group released PHP 5.4.35.

4 security-related bugs were fixed in this release, including the fix for CVE-2014-3710. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.7
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.5.8
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.2.0
xdebug 2.2.6
xhprof 0.9.4
zendopcache 7.0.3

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.19 for Wheezy

Tue, 18 Nov 2014 07:06:45 +0000

On November 13th 2014, the PHP group released PHP 5.5.19.

This release fixes several bugs and one CVE in the fileinfo extension. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.19 packages are now available on Dotdeb for Debian 7.7 “Wheezy”, on both amd64 and i386 architectures. They include a fix for regressions in the FPM SAPI (See 1, 2 and 3) that is present in the upstream version of PHP 5.5.19.

PHP 5.6.3 for Wheezy

Mon, 17 Nov 2014 07:25:03 +0000

On November 13th 2014, the PHP group released PHP 5.6.3.

This release fixes several bugs and one CVE in the fileinfo extension. All PHP 5.6 users are encouraged to upgrade to this version.

PHP 5.6.3 packages are now available on Dotdeb for Debian 7.7 “Wheezy”, on both amd64 and i386 architectures. They include a fix for regressions in the FPM SAPI (See 1, 2 and 3) that is present in the upstream version of PHP 5.6.3.

PHP 5.4.34, for Wheezy and Squeeze

Thu, 23 Oct 2014 22:30:44 +0000

On October 16th 2014, the PHP group released PHP 5.4.34.

6 security-related bugs were fixed in this release, including fixes for CVE-2014-3668, CVE-2014-3669 and CVE-2014-3670. Also, a fix for OpenSSL which produced regressions was reverted. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

PHP 5.5.18 for Debian Wheezy

Wed, 22 Oct 2014 19:34:05 +0000

On October 16th 2014, the PHP group released PHP 5.5.18.

Several bugs were fixed in this release. A regression in OpenSSL introduced in PHP 5.5.17 has also been addressed in this release. PHP 5.5.18 also fixes 4 CVEs in different components. All PHP 5.5 users are encouraged to upgrade to this version.

PHP 5.5.18 packages are now available on Dotdeb for Debian 7.7 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

Nginx 1.6.2, for Wheezy and Squeeze

Sat, 20 Sep 2014 21:21:49 +0000

Nginx 1.6.2 has been released on September 16th 2014, with the following changes :

Security: it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple “server” blocks ( CVE-2014-3616). Thanks to Antoine Delignat-Lavaud.
Bugfix: requests might hang if resolver was used and a DNS server returned a malformed response; the bug had appeared in 1.5.8.
Bugfix: requests might hang if resolver was used and a timeout occurred during a DNS request.

As a consequence, packages of Nginx 1.6.2 are now available for both Debian 7 “Wheezy” and Debian 6 “Squeeze” (amd64/i386).

PHP 5.4.32, for Wheezy and Squeeze

Sat, 23 Aug 2014 12:08:05 +0000

On August 21st 2014, the PHP group has released PHP 5.4.32.

16 bugs were fixed in this release, including the following security-related issues: CVE-2014-2497, CVE-2014-3538, CVE-2014-3587, CVE-2014-3597, CVE-2014-4670, CVE-2014-4698, CVE-2014-5120. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.6
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.5.5
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.1.0
xdebug 2.2.5
xhprof 0.9.4
zendopcache 7.0.3

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.16 for Debian Wheezy

Fri, 22 Aug 2014 16:36:15 +0000

On August 22nd 2014, the PHP group has released PHP 5.5.16.

This release fixes several bugs against PHP 5.5.15 and resolves CVE-2014-3538, CVE-2014-3587, CVE-2014-2497, CVE-2014-5120 and CVE-2014-3597.

All PHP users are encouraged to upgrade to this new version.

PHP 5.5.16 packages are now available on Dotdeb for Debian 7.6 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.6
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.5.5
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.1.0
xdebug 2.2.5
xhprof 0.9.4

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

Nginx 1.6.1, for Wheezy and Squeeze

Fri, 15 Aug 2014 09:01:31 +0000

Nginx 1.6.1 has been released on August 5th 2014, with the following changes :

Security: pipelined commands were not discarded after STARTTLS command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6. Thanks to Chris Boulton.
Bugfix: the $uri variable might contain garbage when returning errors with code 400. Thanks to Sergey Bobrov.
Bugfix: in the none parameter in the smtp_auth directive; the bug had appeared in 1.5.6. Thanks to Svyatoslav Nikolsky.

As a consequence, packages of Nginx 1.6.1 are now available for both Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze” (amd64/i386).

PHP 5.3.29 (End of Life) for Squeeze

Fri, 15 Aug 2014 08:55:04 +0000

On August 14th 2014, the PHP group has released PHP 5.3.29.

The PHP development team announces the immediate availability of PHP 5.3.29. This release marks the end of life of the PHP 5.3 series. Future releases of this series are not planned. All PHP 5.3 users are encouraged to upgrade to the current stable version of PHP 5.5 or previous stable version of PHP 5.4, which are supported till at least 2016 and 2015 respectively.

PHP 5.3.29 contains about 25 potentially security related fixes backported from PHP 5.4 and 5.5.

MySQL 5.5.38 for Squeeze

Mon, 21 Jul 2014 23:20:09 +0000

Packages of MySQL 5.5.38 are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures to fix some vulnerabilities and various bugs as well (the latest packaged version was 5.5.31…).

Please note that the Pinba engine has also been rebuilt to be used against this new version.

As usual, please read carefully the full Changelog before upgrading.

Zabbix 2.2.5

Sat, 19 Jul 2014 06:53:11 +0000

Zabbix 2.2.5 has been released on July 17th 2014. This release contains a security fix, fixes known issues of Zabbix 2.2.x and introduces new minor features. Please read the release notes for more info.

As usual, the packages are now available :

for Debian 7.0 “Wheezy and 6.0 “Squeeze”,
on both amd64 and i386 architectures.

And don’t forget, if you find Dotdeb useful, feel free to show your support.

PHP 5.4.30, for Wheezy and Squeeze

Mon, 30 Jun 2014 06:02:46 +0000

On June 26th 2014, the PHP group has released PHP 5.4.30. Over 20 bugs were fixed in this release, including the following security issues: CVE-2014-3981, CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-4049, CVE-2014-3515. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

PHP 5.5.14 for Debian Wheezy

Sun, 29 Jun 2014 23:23:19 +0000

On June 27th 2014, the PHP group has released PHP 5.5.14.

This release fixes several bugs against PHP 5.5.13. Also, this release fixes a total of 8 CVEs, half of them concerning the FileInfo extension.

All PHP users are encouraged to upgrade to this new version.

Please, note that this release also fixes a backward compatibility issue that has been detected in the PHP 5.5.13 release. Still, the fix in PHP 5.5.14 may break some very rare situations. As this tiny compatibility break involves security, and as security is our primary concern, we had to fix it. This concerns bug 67072. For more information about this bug and its actual resolution, please visit our upgrading guide. We apologize for any inconvenience you may have experienced with this behavior.

Nginx 1.6.0 has been updated for Wheezy and Squeeze

Sun, 29 Jun 2014 22:05:45 +0000

Packages of Nginx 1.6.0 for Debian Wheezy and Squeeze have just been updated to fix a vulnerability in the ngx_pagespeed-embeded OpenSSL library.

The nginx-auth-ldap, nginx-cache-purge, nginx-lua and nginx-upload-progress modules have also been updated.

PHP 5.4.29, for Wheezy and Squeeze

Tue, 10 Jun 2014 06:52:26 +0000

On May 29th 2014, the PHP group has released PHP 5.4.29. 16 bugs were fixed in this release, including two security issues in fileinfo extension. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7 “Wheezy” and Debian 6 “Squeeze”,
on both amd64 and i386 architectures.

The following modules have been packaged too :

APC 3.1.13
apcu 4.0.4
ffmpeg 0.6.0 (Squeeze only)
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.5.3
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.1.0
xdebug 2.2.5
xhprof 0.9.4
zendopcache 7.0.3

Please also note that the default permissions on the FPM Unix socket have been fixed, in a secure way.

PHP 5.5.13 for Debian Wheezy

Sun, 08 Jun 2014 00:52:51 +0000

On May 29th 2014, the PHP group has released PHP 5.5.13 :

This release fixes several bugs in PHP 5.5.12, and addresses two CVEs in Fileinfo ( CVE-2014-0238 and CVE-2014-0237).

As a consequence, PHP 5.5.13 packages are now available on Dotdeb for Debian 7.5 “Wheezy”, on both amd64 and i386 architectures.

The following modules have been packaged too :

apcu 4.0.4
gearman 0.8.3
geoip 1.0.8
imagick 3.1.2
memcache 3.0.8
memcached 2.2.0
mongo 1.5.3
pecl_http 1.7.6
pinba (master)
redis 2.2.5
spplus 1.1
ssh2 0.12
xcache 3.1.0
xdebug 2.2.5
xhprof 0.9.4

Please note that the default permissions on the FPM Unix socket have been fixed, in a secure way.

PHP 5.4.28, for Wheezy and Squeeze

Thu, 08 May 2014 01:42:26 +0000

On May 1st 2014, the PHP group has released PHP 5.4.28. 9 bugs were fixed in this release, including CVE-2014-0185. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.12 for Debian Wheezy

Wed, 07 May 2014 05:44:45 +0000

On April 30th 2014, the PHP group has released PHP 5.5.12 :

This release fixes several bugs against PHP 5.5.11, as well as CVE-2014-0185 regarding PHP-FPM. All PHP users are encouraged to upgrade to this new version.

As a consequence, PHP 5.5.12 packages are now available on Dotdeb for Debian 7.4 “Wheezy”, on both amd64 and i386 architectures.

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

PHP 5.4.27, for Wheezy and Squeeze

Sun, 06 Apr 2014 06:19:46 +0000

On April 3rd 2014, the PHP group has released PHP 5.4.27. 6 bugs were fixed in this release, including CVE-2013-7345. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.11 for Debian Wheezy

Fri, 04 Apr 2014 06:00:52 +0000

On April 2nd 2014, the PHP group has released PHP 5.5.11 :

Several bugs were fixed in this release, some bundled libraries updated and a security issue has been fixed : CVE-2013-7345. We recommand all PHP 5.5 users to upgrade to this version.

As a consequence, PHP 5.5.11 packages are now available on Dotdeb for Debian 7.4 “Wheezy”, on both amd64 and i386 architectures.

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

Security : Nginx 1.4.7, for Wheezy and Squeeze

Wed, 19 Mar 2014 05:50:58 +0000

Nginx 1.4.7 has been released on March 18th 2014, fixing a potential heap memory buffer overflow when using SPDY, and also the fastcgi_next_upstream directive. More info in the changelog.

As a consequence, Dotdeb’s packages of Nginx 1.4.7 are now available for both Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze” (amd64/i386).

As usual, if you want to know which module has been included in each Nginx flavor, you just have to look at this document.

PHP 5.4.26, for Wheezy and Squeeze

Fri, 07 Mar 2014 11:05:08 +0000

On March 7th 2014, the PHP group has released PHP 5.4.26. 5 bugs were fixed in this release, including CVE-2014-1943. All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.5.10, for Debian 7.0 "Wheezy"

Thu, 06 Mar 2014 21:10:59 +0000

On March 6th 2014, the PHP group has released PHP 5.5.10. Several bugs were fixed in this release, including security issues related to CVEs. CVE-2014-1943, CVE-2014-2270 and CVE-2013-7327 have been addressed in this release. All PHP 5.5 users should upgrade to this version.

As a consequence, PHP 5.5.10 packages are now available on Dotdeb for Debian 7.0 “Wheezy”, on both amd64 and i386 architectures.

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

Percona toolkit 2.2.7

Thu, 06 Mar 2014 18:36:29 +0000

Percona toolkit 2.2.7 is now available on Dotdeb for both Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”. This release fixes one security bug. An upgrade is recommended.

As usual, before upgrading, please read the list of changes for Percona toolkit 2.2.7 and the announcement by Hrvoje Matijakovic.

Security : Nginx 1.4.6, for Wheezy and Squeeze

Thu, 06 Mar 2014 16:50:43 +0000

Nginx 1.4.6 has been released on March 4th 2014, fixing client_max_body_size when used with chunked transfer encoding and a segfault when proxying WebSocket connections. More info in the changelog.

As a consequence, Dotdeb’s packages of Nginx 1.4.6 are now available for both Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze” (amd64/i386), with some extra changes :

nginx-auth-ldap is now available in nginx-extras,
modules have been updated.

As usual, if you want to know which module has been included in each Nginx flavor, you just have to look at this document.

Redis 2.8.5

Mon, 10 Feb 2014 03:54:54 +0000

Redis 2.8.5 has been released on February 4th 2014, bringing the following changes (take a look at the Changelog) :

[FIX] Fixed a replication bug caused by Lua scripts + expired keys: keys could expire in the middle of scripts causing non-deterministic behavior.
[FIX] MISCONFIG error if condition fixed, the server was no longer able to stop writes on RDB misconfiguration after this error was introduced.
[FIX] REDIS_AOF_REWRITE_MIN_SIZE is now 64mb like example redis.conf default.
[FIX] Perform fflush() before fsync() in rio.c (bug without actual effects).
[FIX] Don’t log MONITOR clients as disconnecting slaves.
[FIX] SENTINEL MASTER arity check fixed. Crashed the Sentinel instance when the command was given without arguments.
[NEW] Allow CONFIG and SHUTDOWN while in stale-slave state.
[NEW] Support for configurable TCP listen(2) backlog size.
[NEW] redis-cli supports SCAN via the --scan and --pattern options.
[NEW] SENTINEL SET master quorum via runtime API implemented.

The upgrade urgency high for Redis, low for Sentinel. Redis users using Lua scripts with expires, and Redis users relying on the ability of Redis to block writes on RDB saving errors should plan to upgrade a.s.a.p.

PHP 5.5.7, for Debian 7.0 "Wheezy"

Sun, 15 Dec 2013 21:53:08 +0000

On December 12th 2013, the PHP group has released PHP 5.5.7. This release fixes some bugs against PHP 5.5.6 and it also includes a fix for CVE-2013-6420 in OpenSSL extension. All users are strongly encouraged to upgrade.

As a consequence, PHP 5.5.7 packages are now available on Dotdeb for Debian 7.0 “Wheezy”, on both amd64 and i386 architectures.

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

PHP 5.4.23, for Wheezy and Squeeze

Sat, 14 Dec 2013 02:39:53 +0000

On December 12th 2013, the PHP group has released PHP 5.4.23. About 10 bugs were fixed, including a security issue in OpenSSL module ( CVE-2013-6420). All PHP 5.4 users are encouraged to upgrade to this version.

The corresponding packages are now available on Dotdeb :

for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.3.28 for Squeeze

Fri, 13 Dec 2013 15:55:06 +0000

On December 12th 2013, the PHP group has released PHP 5.3.28.

The PHP development team announces the immediate availability of PHP 5.3.28. This release fixes two security issues in OpenSSL module in PHP 5.3 - CVE-2013-4073 and CVE-2013-6420. All PHP 5.3 users are encouraged to upgrade to PHP 5.3.28 or latest versions of PHP 5.4 or PHP 5.5.

The corresponding packages are now available on Dotdeb for Debian 6.0 “Squeeze”, on both amd64 and i386 architectures.

Security : Nginx 1.4.4 for Wheezy and Squeeze

Tue, 19 Nov 2013 18:45:04 +0000

Nginx 1.4.4 has been released on November 19th 2013, fixing a request line parsing vulnerability by Ivan Fratric of the Google Security Team (CVE-2013-4547). More info in the changelog.

As a consequence, Dotdeb’s packages of Nginx 1.4.4 are now available for both Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze” (amd64/i386).

Reminder : Users of naxsi-ui should be aware that it has been deprecated in the upcoming Naxsi 0.53 and that it won’t be provided by Dotdeb starting with the next Nginx packages.

Zabbix 2.0.9

Wed, 09 Oct 2013 05:26:43 +0000

Zabbix 2.0.9 has been released on October 8th 2013. It fixes critical security issues, as well as known issues of Zabbix 2.0.x, and introduces new minor features (take a look at the Zabbix 2.0.9 release notes for more info).

The packages are now available :

for Debian 7.0 “Wheezy and 6.0 “Squeeze”,
on both amd64 and i386 architectures.

PHP 5.5.3, for Debian 7.0 "Wheezy"

Thu, 29 Aug 2013 22:10:28 +0000

On August 22nd 2013, the PHP group has released PHP 5.5.3. Since the previously-packaged PHP 5.5.1 version, about 20 bugs were fixed, including security issue in OpenSSL module (CVE-2013-4248) and session fixation problem (CVE-2011-4718).

As a consequence, PHP 5.5.3 packages are now available on Dotdeb for Debian 7.0 “Wheezy”, on both amd64 and i386 architectures, with the following changes :

each SAPI (apache2, apache2filter, CLI, CGI, FPM, embed) has now its own /etc/php5/SAPI/conf.d/ subdirectory, not just a symlink to a common one, so it can have its own list of activated modules (it involved some more tests, so sorry for the delay),
the php5-mongo package is now available, allowing you interacting with MongoDB servers,
the php5-fpm init script now reports syntax errors with full error messages.

Please read the Changelog and the migration guide (be aware of the backward incompatible changes) before upgrading.

PHP 5.4.19, for Wheezy and Squeeze

Tue, 27 Aug 2013 04:50:59 +0000

On August 22nd 2013, the PHP group has released PHP 5.4.19. It fixes a bug in the patch for CVE-2013-4248 in OpenSSL module. All PHP users are encouraged to upgrade to PHP 5.4.19.

The corresponding packages are now available on Dotdeb :

for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.4.18, for Wheezy and Squeeze

Wed, 21 Aug 2013 17:56:40 +0000

On August 15th 2013, the PHP group has released PHP 5.4.18.

About 30 bugs were fixed, including security issues CVE-2013-4113 and CVE-2013-4248. All users of PHP are encouraged to upgrade to this release.

On the Dotdeb side,

the php5-mongo package is now available, allowing you interacting with MongoDB servers,
the php5-fpm init script now reports syntax errors with full error messages.

The corresponding packages are now available on Dotdeb :

for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.3.26 for Squeeze

Sun, 09 Jun 2013 04:46:22 +0000

On June 6th 2013, the PHP group has released PHP 5.3.26.

These releases fix about 15 bugs, including CVE-2013-2110. All users of PHP are encouraged to upgrade to PHP 5.4.16.

The corresponding packages are now available on Dotdeb for Debian 6.0 “Squeeze”, on both amd64 and i386 architectures.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

And if you like Dotdeb, feel free to show your support.

PHP 5.4.16 for Wheezy and Squeeze

Sun, 09 Jun 2013 01:49:16 +0000

On June 6th 2013, the PHP group has released PHP 5.4.16.

These releases fix about 15 bugs, including CVE-2013-2110. All users of PHP are encouraged to upgrade to PHP 5.4.16.

The corresponding packages are now available on Dotdeb :

for Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze”,
on both amd64 and i386 architectures.

Please note that php5-readline is now a separate package and that php5-pinba is back.

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

MySQL 5.5.31 for Squeeze

Sun, 19 May 2013 04:09:08 +0000

Packages of MySQL 5.5.31 are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures. They fix some serious vulnerabilities and InnoDB-, partition- and replication-related bugs as well.

Please note that the Pinba engine has also been rebuilt to be used against this new version.

As usual, please read carefully the full Changelog before upgrading.

Security : Nginx 1.4.1

Tue, 07 May 2013 14:12:53 +0000

Nginx 1.4.1 has been released on May 7th 2013, with the fix for the stack-based buffer overflow security problem in nginx 1.3.9 - 1.4.0, discovered by Greg MacManus, of iSIGHT Partners Labs (CVE-2013-2028).

As a consequence, Dotdeb’s packages of Nginx 1.4.1 are now available for both Debian 7.0 “Wheezy” and Debian 6.0 “Squeeze” (amd64/i386).

As usual, if you want to know which module has been included in each Nginx flavor, you just have to look at this document.

PHP 5.3.23

Tue, 26 Mar 2013 11:14:48 +0000

On March 14th 2013, the PHP group has released PHP 5.3.23.

These releases fix about 15 bugs, including fixes for CVE-2013-1643 and CVE-2013-1635. All users of PHP are encouraged to upgrade to PHP 5.4.13.

The corresponding packages are now available on Dotdeb for Debian 6.0 “Squeeze” on both amd64 and i386 architectures with the following changes :

php5-xdebug as been upgraded to version 2.2.2
php5-apc fixes a bug in relative path search when apc.stats = 0

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.4.13

Thu, 21 Mar 2013 22:45:10 +0000

On March 14th 2013, the PHP group has released PHP 5.4.13.

These releases fix about 15 bugs, including fixes for CVE-2013-1643 and CVE-2013-1635. All users of PHP are encouraged to upgrade to PHP 5.4.13.

The corresponding packages are now available on Dotdeb for Debian 6.0 “Squeeze” on both amd64 and i386 architectures with the following changes :

php5-ffmpeg is now compatible with PHP 5.4
php5-apc fixes a bug in relative path search when apc.stats = 0

As usual, please read the ChangeLog before upgrading and be sure to use to the latest packages before reporting any issue.

PHP 5.4.5 and PHP 5.3.15

Mon, 23 Jul 2012 14:25:59 +0000

On july 19th 2012, the PHP group has released PHP 5.4.5 and PHP 5.3.15, that bring over 30 bug fixes, including a fix for a security related overflow issue in the stream implementation.

The corresponding packages are now available on Dotdeb for Debian 6.0 “Squeeze” on both amd64 and i386 architectures (see the installation instructions). Please also note that the php5-xhprof package is now available for PHP 5.4.

Critical update : MySQL 5.5.25a

Tue, 10 Jul 2012 06:32:57 +0000

The packages of MySQL 5.5.25a are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures. They fixes a very annoying bug on InnoDB : bug #65745, “UPDATE on InnoDB table enters recursion, eats all disk space”.

As usual, please read carefully the full Changelog before upgrading.

PHP 5.3.14

Thu, 21 Jun 2012 05:21:26 +0000

On june 14th 2012, the PHP group has released PHP 5.3.14, that brings over 30 bug fixes, some of which are security related : A weakness in the DES implementation of crypt and a heap overflow issue in the phar extension. Please also note that the use of php://fd streams is now restricted to the CLI SAPI ( php5-cli).

Packages of PHP 5.3.14 are now available on Dotdeb for Debian 6.0 “Squeeze” on both amd64 and i386 architectures.

MySQL 5.1 discontinued on Dotdeb

Wed, 20 Jun 2012 18:20:08 +0000

During the last weeks, MySQL suffered from many vulnerabilities (see DSA-2429-1 and DSA-2496-1). Due to the non-disclosure of security patch information from Oracle, the Debian security team is now forced to ship upstreams version update of MySQL 5.1 (5.1.63 as of this writing).

Then it makes no sense for Dotdeb to duplicate this effort and to maintain the same versions of MySQL 5.1 for Squeeze with the same features and level of optimization. As a consequence the MySQL 5.1 packages has been removed from the Dotdeb repository (you’ll find archived versions here).

Redis 2.4.14

Wed, 23 May 2012 10:11:14 +0000

Redis 2.4.14 has been released to fix many non trivial bugs :

[BUGFIX] Fixed issue #518 (Redis 99% CPU when master down).
[BUGFIX] Fixed issue #516 ( ZINTERSTORE mixing sets and zsets).
[BUGFIX] Fixed a bug in install_server.sh when using chkconfig
[BUGFIX] Fixes to --test-memory implementation.
[BUGFIX] Allow PREFIX to be overridden in Makefile.
[BUGFIX] The test is now more reliable on slow computers.
redis-cli –pipe mode, see http://redis.io/topics/mass-insert
Much better expired keys collection algorithm that makes the server much more responsive when a lot of keys are expiring at the same time.

The packages are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures. The upgrade urgency is high.

Security : PHP 5.4.3 and PHP 5.3.13

Tue, 08 May 2012 22:52:22 +0000

PHP 5.4.3 and PHP 5.3.13 have been released by the PHP development team to fix some critical security issues :

Source code disclosure with a trivial request (CVE-2012-1823 and CVE-2012-2311) - PHP 5.4 and 5.3 are vulnerable
buffer overflow in apache_request_headers() (CVE-2012-2329) - only PHP 5.4 is vulnerable.

If you’re using the CGI flavor of PHP, upgrading is highly recommended. You can see more info on PHP’s website and on this useful blog post.

MySQL 5.5.24

Tue, 08 May 2012 15:09:50 +0000

The packages of MySQL 5.5.24 are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures. It fixes an undisclosed security issue (thanks Oracle) and some other bugs as well.

As usual, please read carefully the full Changelog before upgrading.

Note : the packages have been updated to include a missing init script. Sorry for the mess.

Security update : MySQL 5.1.62

Sat, 05 May 2012 11:03:05 +0000

MySQL 5.1.62 packages are now available for Debian 6.0 “Squeeze” on amd64 and i386 architectures.

This is a important security update that fixes unspecified vulnerabilities identified by Oracle in all versions of MySQL 5.1 earlier than 5.1.62. If you did not upgrade to MySQL 5.5, please consider upgrading your MySQL server (at least) to 5.1.62.

FYI, CVE list is as follows :

The corresponding Pinba storage engine has also been rebuilt.

Redis 2.4.13

Wed, 02 May 2012 10:54:23 +0000

Redis 2.4.13 has been released to fix a critical bug in KEYS command :

[BUGFIX] Fix for KEYS command: if the DB contains keys with expires the KEYS command may return the wrong output, having duplicated or missing keys. See issue #487 and #488 on github for details.

The packages are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures. Upgrading is strongly advised.

Nginx 1.2.0 with Naxsi 0.45 and Passenger 3.0.12

Sun, 29 Apr 2012 16:59:10 +0000

Dotdeb’s packages of the long-awaited Nginx 1.2.0 are now available for Debian 6.0 “Squeeze” (amd64/i386) in five flavors : nginx-light, nginx-naxsi, nginx-full, nginx-passenger and nginx-extras.

This is a major release with a lot of improvements since the former 1.0 branch. Please take a look at Nginx’ official Changelog before upgrading.

On the Dotdeb side :

Naxsi, a high performance, low rules maintenance, Web Application Firewall module, has been upgraded to its 0.45 version. Please read its documentation fore more info.
Passenger has been upgraded to its 3.0.12 version.
Because nginx-passenger is now dedicated to Passenger, nginx-extras does not contain it anymore. Don’t forget to backup your configuration files when switching from nginx-extras to nginx-passenger.

If you want to know which module has been included in each Nginx flavor, you just have to look at this useful document.

Security : Nginx 1.0.15

Thu, 12 Apr 2012 20:32:03 +0000

Nginx 1.0.15 packages are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures. They fix a buffer overflow in the ngx_http_mp4_module :

Security: specially crafted mp4 file might allow to overwrite memory locations in a worker process if the ngx_http_mp4_module was used, potentially resulting in arbitrary code execution ( CVE-2012-2089). Thanks to Matthew Daley.
Bugfix: in the ngx_http_mp4_module.

Upgrading is recommended if you’re using the nginx-extras packages.

Security : Nginx 1.0.14

Thu, 15 Mar 2012 16:21:19 +0000

Nginx 1.0.14 packages are now available for Debian 6.0 “Squeeze” on both amd64 and i386 architectures. They fix a potential memory disclosure :

Security: content of previously freed memory might be sent to a client if backend returned specially crafted response. Thanks to Matthew Daley.

Upgrading is strongly recommended.

Security update : MySQL 5.1.61

Thu, 08 Mar 2012 00:16:19 +0000

MySQL 5.1.61 packages are now available for Debian 6.0 “Squeeze” on amd64 and i386 architectures.

This is a very important security update that fixes unspecified vulnerabilities identified by Oracle in all versions of MySQL 5.1 earlier than 5.1.61. If you did not upgrade to MySQL 5.5, please consider upgrading your MySQL server (at least) to 5.1.61.

FYI, CVE list is as follows :

The corresponding Pinba storage engine has also been rebuilt.

Security update : PHP 5.3.10

Fri, 03 Feb 2012 01:25:52 +0000

A few hours ago, PHP 5.3.10 has been released by the PHP Group. It’s an important security update for PHP 5.3.9 users : Stefan Esser discovered a remotely exploitable bug, introduced with PHP 5.3.9’s max_input_vars directive (CVE-2012-0830). You really should upgrade as soon as possible.

Packages of PHP 5.3.10 are now available for :

both Debian 6.0 “Squeeze” and Debian 5.0 “Lenny”,
both amd64 and i386 architectures.

(Lenny packages will be available on php53.dotdeb.org during two weeks before being migrated to archives.dotdeb.org because of the end of Lenny’s security support)

Advisory : buffer overflow in php5-suhosin

Tue, 24 Jan 2012 15:02:26 +0000

A few days ago, Stefan Esser discovered a buffer overflow in the “transparent cookie encryption stack” of the Suhosin extension. Here is the full advisory.

If you previously installed the php5-suhosin package, you should upgrade to its fixed new version (0.9.33) by running :

apt-get update
apt-get install --reinstall php5-suhosin

No more Debian 5.0 "Lenny" support after february 2012

Wed, 07 Dec 2011 23:10:37 +0000

The Debian project has announced in a security advisory ( DSA-2360-1) that the security support for Debian GNU/Linux 5.0 “Lenny” will be terminated in february 2012 :

This is an advance notice that security support for Debian GNU/Linux 5.0
(code name "lenny") will be terminated in two months.

The Debian project released Debian GNU/Linux 6.0 alias "squeeze" on the
6th of February 2011. Users and distributors have been given a one-year
timeframe to upgrade their old installations to the current stable
release. Hence, the security support for the old release of 5.0 is going
to end on the 6th of February 2012 as previously announced.

Previously announced security updates for the old release will continue
to be available on security.debian.org.

FYI, Dotdeb will follow this decision and no new packages will be available for Debian 5.0 after february 2012. Don’t be sad, this will give me some free time to focus on PHP 5.4 packages and some more cool tools.

PHP 5.3.6 is available

Sat, 09 Apr 2011 16:07:34 +0000

On March 17th, the PHP Group released PHP 5.3.6. This maintainance release, that focuses on security, is now available on Dotdeb for Debian 6.0 “Squeeze” in amd64 and i386 flavours.

The compatibility with the official Debian packages has been improved and you (especially the FPM users) should really take care of some important changes that I made :

the intl extension is now built in a separate package : php5-intl
the FPM binary is now /usr/sbin/php5-fpm (previously /usr/bin/php5-fpm)
the FPM configuration file is now /etc/php5/fpm/php-fpm.conf (previously /etc/php5/fpm/php5-fpm.conf)
the FPM pools have to be moved to /etc/php5/fpm/pool.d/ (previously /etc/php5/fpm/pools/)

As usual, please read the Changelog before upgrading.

You really should upgrade to PHP 5.3.5 or 5.2.17

Fri, 07 Jan 2011 10:53:42 +0000

A few days after releasing PHP 5.3.4 and PHP 5.2.16, the PHP group announced an important security update with PHP 5.3.5 and PHP 5.2.17 :

This release resolves a critical issue, reported as PHP bug #53632 and CVE-2010-4645, where conversions from string to double might cause the PHP interpreter to hang on systems using x87 FPU registers.

The problem is known to only affect x86 32-bit PHP processes, regardless of whether the system hosting PHP is 32-bit or 64-bit. You can test whether your system is affected by running this script from the command line.

All users of PHP are strongly advised to update to these versions immediately.

Packages of MySQL 5.1.53 are available for Lenny... and Squeeze!

Sun, 05 Dec 2010 22:50:38 +0000

MySQL 5.1.53 packages for Debian 5.0 « Lenny » are now available on Dotdeb in amd64/i386 flavours. Please note that they’re available as preview for Squeeze too.

This maintainance release fixes many bugs and security issues. Upgrading is strongly recommended after having read the Changelogs here and here.

Upgrade to MySQL 5.1.51! It fixes a DoS vulnerability

Tue, 05 Oct 2010 21:14:32 +0000

MySQL versions prior to 5.1.51 (including 5.1.50) suffer from a vulnerability in the processing of arguments passed to the LEAST() or GREATEST() functions. This issue could be exploited by a malicious user to cause a server crash, leading to a DoS condition.

You really should upgrade your Lenny servers (amd64 or i386) with the new packages of MySQL 5.1.51 from Dotdeb. As usual, don’t forget to read the Changelog before upgrading.

Dotdeb packages are now signed!

Sun, 11 Jul 2010 15:35:51 +0000

After many requests from several users and after many months of promise, the Dotdeb repositories are GPG-signed. Yes, you can now get rid of the annoying " WARNING: The following packages cannot be authenticated!" message!

Waiting for a dotdeb-keyring package, you just have to get the key and add it to your trusted keys’ keyring :

gpg --keyserver keys.gnupg.net --recv-key 89DF5277
gpg -a --export 89DF5277 | sudo apt-key add -

I hope you’ll enjoy it.

MySQL 5.1.47, a security-focused release, is available

Tue, 25 May 2010 16:38:01 +0000

MySQL 5.1.47 is now available on Dotdeb for your Lenny servers, in amd64 and i386 flavours.

This is a security-oriented release that fixes some serious flaws… Please read full changelog for more information.

Please also note that the InnoDB plugin has been upgraded to version 1.0.8 and is now considered of General Availability quality. Feel free to use it for a performance boost.

May is the month of PHP security

Tue, 04 May 2010 12:26:21 +0000

According to Stefan Esser, author of the Suhosin patch, May 2010 will be the “Month of PHP Security” :

This initiative continues the effort of Hardened-PHP’s Month of PHP Bugs in 2007 to improve the security of PHP and the PHP ecosystem by disclosing vulnerabilities in PHP and PHP applications on the one hand and on the other hand by publishing articles and tools that help PHP application developers to develop more secure PHP applications.

Etch security support discontinued by Debian on Feb. 15th...

Wed, 20 Jan 2010 21:33:02 +0000

The Debian security team announced that Debian 4.0 “Etch” security support will be ended on February 15th, 2010 :

Security Support for Debian GNU/Linux 4.0 to be discontinued on
February 15th

One year after the release of Debian GNU/Linux 5.0 alias 'lenny' and
nearly three years after the release of Debian GNU/Linux 4.0 alias
'etch' the security support for the old distribution (4.0 alias
'etch') is coming to an end next month. The Debian project is proud
to be able to support its old distribution for such a long time and
even for one year after a new version has been released.

The Debian project has released Debian GNU/Linux 5.0 alias 'lenny' on
the 14th of February 2009. Users and Distributors have been given a
one-year timeframe to upgrade their old installations to the current
stable release. Hence, the security support for the old release of
4.0 is going to end in February 2010 as previously announced.

Previously announced security updates for the old release will continue
to be available on security.debian.org.

Then, Dotdeb will follow the Debian project and all the Etch packages will be moved to http://archives.dotdeb.org/ on Feb. 15th.

MySQL 5.1.41 has been updated to fix a security issue

Wed, 20 Jan 2010 20:25:13 +0000

I just uploaded new MySQL 5.1.41 packages that fix a remote buffer overflow in MySQL servers that use the embedded YaSSL library :

Lenz Grimmer gives more information about this issue
CVE-2009-4484 has been filled

Since Debian and Dotdeb are impacted, you are strongly encouraged to upgrade your servers.

MySQL 5.0.77 available

Wed, 18 Feb 2009 16:49:58 +0000

MySQL 5.0.77 packages are now available on Dotdeb for Debian Etch amd64/i386.

PHP 5.2.8 available

Tue, 09 Dec 2008 12:30:31 +0000

PHP 5.2.8 is now available on Dotdeb to fix one major security issue.

PHP 5.2.7 updated because magic_quotes_gpc is broken

Sun, 07 Dec 2008 17:54:36 +0000

Stefan Esser has posted a warning about upgrading PHP to the 5.2.7 release :

(…)a change in the ext/filter extension that by default processes all incoming data, broke the magic_quotes_gpc feature. While magic_quotes_gpc itself is deprecated and it is recommended to not rely on it as protection against SQL injection, it is still used in many legacy applications that become very insecure once it is turned off. And exactly that happens with the upgrade to PHP 5.2.7. The fix for this was already commited to the PHP CVS and PHP 5.2.8 will be released next week.