Zend Server Release Notes

Note: 9.1.16 is the final release version for Zend Server 9.1.

PHP version 7.1.33.18.

Backported CVE fixes

• Core
  • Fixed bug #81744 (password_verify() always return true with some hashes). (CVE-2023-0567)
  • Fixed bug #81746 (1-byte array overrun in common

PHP version 7.1.33.16.

Backported CVE fixes

• Core
  • Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
  • Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022

Fixed

• JobQueue HTTPS requests failure on IBM i
• Change lighttpd configuration for HTTPv.1.1 compatibility
• JobQueue incorrect behavior during DST change
•  Zend Server RPM php-sources-zend-server packages missing PHP 7.1 sources

Updated

• Upgrade angularjs

PHP version 5.6.40.17.

Backported CVE fixes

• Core:
  • Fixed bug #81726: phar wrapper: DOS when using quine gzip file (CVE-2022-31628).
  • Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning (CVE-2022

CVE Fixes for PHP versions: 7.1.33.16, 7.2.34.11, 7.3.33.3

• Hash
  • Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)

CVE Fixes for PHP versions 7.1.33.16, 7.2.34.11, 7.3.33.3

• Core
  • Fixed bug #81726: phar wrapper

PHP version 5.6.40.16.

Backported CVE fixes

• mysqlnd:
  • Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
• pgsql
  • Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)

PHP version 7.1.33.15.

Backported CVE fixes

• mysqlnd
  • Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
• pgsql
  • Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)

Updated PHP versions

• 7.1.33.15 (incl. TLSv1.2 support for mysql)
• 7.2.34.10
• 7.3.33.2

CVE Fixes

• mysqlnd
  • Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
• pgsql
  • Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE

Added

• webp support for gd extension, linux and IBM i (ZEND-2255,2084)

Fixed

• jobqueueAddJob output in JSON format (ZEND-2244)
• ZendServer MonitorNode schema check with invalid version  (ZEND-2077)
• Vhost attach functionality with Nginx (ZEND-2351)
• Install

Changes

• Default customer web server port on IBM i Apache instance changed from 10080 to 10280 (ZEND-2258)
• Updated PHP versions to 7.1.33.14, 7.2.34.9, 7.3.33.1
  • PHP CVE fixes after 2019.0.7: CVE-2021-21703, CVE-2021-21704, CVE-2021-21705, CVE-2021-21706