Zend Server Release Notes

Contains only PHP security fixes and updated apache, lighttpd, curl, openssl components. No changes in Zend Server

Backported PHP CVE fixes

• PHP version 7.1.33.23, 7.2.34.19, 7.3.33.11 CVE fixes

  • CGI

    • Fixed bug GHSA-3qgc-jrrr-25jv: Bypass of CVE-2012

Contains only PHP security fixes and updated apache, lighttpd, curl, openssl components. No changes in Zend Server

Backported PHP CVE fixes

• PHP version 7.1.33.23, 7.2.34.19, 7.3.33.11, 7.4.33.6 CVE fixes

  • CGI

    • Fixed bug GHSA-3qgc-jrrr-25jv: Bypass of

Contains only PHP and installer/packaging fixes/changes.

Backported PHP CVE fixes:

• PHP version 7.1.33.22, 7.2.34.18, 7.3.33.10 CVE fixes:
  • Standard:
    • Fixed bug GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE

Contains only PHP and installer/packaging fixes/changes.

Added

• Adds support for Rocky Linux 8 (x68_64 only)
  • ZS Repository Installer script updated to allow usage with Rocky Linux 8.

Backported PHP CVE fixes

• PHP version 7.1.33.22, 7.2.34.18, 7.3.33

Security Updates

• cURL update to 8.4.0; Windows release only.
• IBM i users can download a patched version of cURL here: https://downloads.zend.com/zendserver/2019.1.4/zend-server-2019.1.4-curl-8.4.0-pase.tar.gz

Security Updates

• cURL updated to 8.4.0; Windows release only.

Contains only PHP and installer/packaging fixes/changes; no changes in Zend Server.

Backported PHP 7.1.33.21, 7.2.34.17, 7.3.33.9 CVE Fixes

• Libxml: Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it).

Changes

• Added Support for IBM i 7.5

Backported PHP CVE fixes

• PHP version 7.1.33.21, 7.2.34.17, 7.3.33.9, 7.4.33.4
  • Libxml: Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
  • Phar

Backported PHP CVE fixes

• PHP version 7.1.33.18, 7.2.34.14, 7.3.33.6, 7.4.33.2
  • Core
    • Fixed bug #81744 (Password_verify() always return true with some hash).   (CVE-2023-0567)
    • Fixed bug #81746 (1-byte array overrun in common path resolve code).   (CVE

PHP fixes only.

PHP version 7.1.33.18, 7.2.34.14, 7.3.33.6 CVE fixes

• Core
  • Fixed bug #81744 (password_verify() always return true with some hash). (CVE-2023-0567)
  • Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
• FPM