RHBA-2014:1465 - Bug Fix Advisory

Topic

Updated php packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP
Server.

This update fixes the following bugs:

• Previously, an incorrect parameter type was used in internal calls. As a

consequence, the execution of the php-mysql module requests did not work
correctly on big-endian machines, such as 64-bit PowerPC and IBM System z. The
parameter has been
changed to match the expected type. As a result, php-mysql requests produce the
expected output. (BZ#1054953)

• Prior to this update, a mysql link could be closed even when prepared

statements still existed. Consequently, executing those statements caused a
segmentation fault. With this update, a mysql link is only closed when all
statements are freed, and the statements can be executed as expected.
(BZ#1069167)

• Previously, the host HTTP header was missing from soap calls. As a

consequence, HTTP requests were not RFC2616 compliant. This update adds the HTTP
header to the soap calls. As a result, the requests are now RFC2616 compliant
and can go through a proxy server. (BZ#1045019)

• Previously, the php packages contained a bug concerning the oci_lob_load()

function. As a consequence, compiling the php OCI8 module failed. The underlying
source code has been modified, and the OCI8 extension can now be compiled
correctly. (BZ#1053982)

• Prior to this update, dependency on the Spl extension for the Session

extension was missing from the php packages. Consequently, Spl was uninitialized
before Session, which made the autoload feature unavailable. With this update,
Session requires Spl and the autoload feature is now available as expected.
(BZ#954027)

• Previously, the php packages contained an inconsistency in the behavior of a

static call in a non-static method. Consequently, a call from the context's
class (name, static or self) inside a non-static method results in a
static-call. This update restores the standard behavior. As a result, a call
inside a non-static method is now non-static, and the called method inherits the
$this variable. (BZ#953786)

Users of php are advised to upgrade to these updated packages, which fix these
bugs. After installing the updated packages, the httpd daemon must be restarted
for the update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 953786 - Static calling in non-static method not behaves like $this
• BZ - 954027 - autoload misbehaves if called from closing session
• BZ - 1053301 - PHP 5.3 with XDebug enabled always returns '200 OK' status despite PHP syntax error
• BZ - 1053982 - php: CVE-2006-7243 patch issues in oci8 and odbc

CVEs

(none)

References

(none)