Zend Server Release Notes

Changes

• Default customer web server port on IBM i Apache instance changed from 10080 to 10280 (ZEND-2258)
• Updated PHP versions to 7.1.33.14, 7.2.34.9, 7.3.33.1
  • PHP CVE fixes after 2019.0.7: CVE-2021-21703, CVE-2021-21704, CVE-2021-21705, CVE-2021-21706

PHP version 7.1.33.13.

Changes

• Adds TLS v1.2 support for mysqlnd.

Backported CVE fixes

• Fix #79971: special character is breaking the path in xml function CVE-2021-2170729
• Fix bug #81026 (PHP-FPM oob R/W in root process leading to priv escalation) CVE

Updates

• Updated to PHP 7.4.28
• Updated to 7.1.33.12
• Updated to 7.2.34.8
• Updated to 7.3.33

All above versions were rebuilt with the latest timezone database.

Backported CVE Fixes

• Fix #81708: UAF due to php_filter_float() failing for ints. Relevant for

Updated PHP from 7.4.22 to 7.4.26

• Core
  • Fixed bug #81518 (Header injection via default_mimetype / default_charset).
• Date
  • Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2)
• MBString
  • Fixed bug #76167 (mbstring may use pointer

Fixed

• Code Tracing
  • A conflicting function flag value with PHP 7.4 when marking traceable PHP internal functions led to potential memory leaks. In addition, Code Tracing was including extra PHP internal functions in code traces that were not supposed to

The list below provides the full release notes and changelog for Zend Server 2021.x.

Download Available Now for Linux, Windows, and IBM i

Zend Server 2021.3.2 (August 2023)

Changes

- Added Support for IBM i 7.5

- Backported

Version 2019.1.5 (October 2023)

Zend Server installer Windows package contains cURL library version 8.4.0 fixing CVE-2023-38545.

Zend Server Linux installation uses Linux distribution packages for curl library. Users shall update linux packages to fix