Zend Server Release Notes

Deprecated support for IBM i v7r2 due to openssl 1.1.1 deprecation by IBM. All IBM i >= v7r3 must use at least OSS base 7.3 to be able to install/upgrade.

Fixed

• Zend Server Z-Ray Database Queries failed to update placeholder value bindings in queries

Contains only PHP security fixes and updated apache, lighttpd, curl, openssl components. No changes in Zend Server

Backported PHP CVE fixes

• PHP version 7.1.33.23, 7.2.34.19, 7.3.33.11 CVE fixes

  • CGI

    • Fixed bug GHSA-3qgc-jrrr-25jv: Bypass of CVE-2012

Contains only PHP security fixes and updated apache, lighttpd, curl, openssl components. No changes in Zend Server

Backported PHP CVE fixes

• PHP version 7.1.33.23, 7.2.34.19, 7.3.33.11, 7.4.33.6 CVE fixes

  • CGI

    • Fixed bug GHSA-3qgc-jrrr-25jv: Bypass of

Contains only PHP and installer/packaging fixes/changes.

Backported PHP CVE fixes:

• PHP version 7.1.33.22, 7.2.34.18, 7.3.33.10 CVE fixes:
  • Standard:
    • Fixed bug GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE

Contains only PHP and installer/packaging fixes/changes.

Added

• Adds support for Rocky Linux 8 (x68_64 only)
  • ZS Repository Installer script updated to allow usage with Rocky Linux 8.

Backported PHP CVE fixes

• PHP version 7.1.33.22, 7.2.34.18, 7.3.33

Security Updates

• cURL update to 8.4.0; Windows release only.
• IBM i users can download a patched version of cURL here: https://downloads.zend.com/zendserver/2019.1.4/zend-server-2019.1.4-curl-8.4.0-pase.tar.gz

Security Updates

• cURL updated to 8.4.0; Windows release only.

Contains only PHP and installer/packaging fixes/changes; no changes in Zend Server.

Backported PHP 7.1.33.21, 7.2.34.17, 7.3.33.9 CVE Fixes

• Libxml: Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it).

Changes

• Added Support for IBM i 7.5

Backported PHP CVE fixes

• PHP version 7.1.33.21, 7.2.34.17, 7.3.33.9, 7.4.33.4
  • Libxml: Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
  • Phar

Backported PHP CVE fixes

• PHP version 7.1.33.18, 7.2.34.14, 7.3.33.6, 7.4.33.2
  • Core
    • Fixed bug #81744 (Password_verify() always return true with some hash).   (CVE-2023-0567)
    • Fixed bug #81746 (1-byte array overrun in common path resolve code).   (CVE