Skip to content
This repository has been archived by the owner on May 16, 2018. It is now read-only.

Commit

Permalink
Merge branch 'releases/1.12.15'
Browse files Browse the repository at this point in the history
1.12.15 readiness
  • Loading branch information
weierophinney committed Aug 11, 2015
2 parents 5356b45 + 51a0441 commit c7d193c
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 17 deletions.
33 changes: 17 additions & 16 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,25 +7,26 @@ Master: [![Build Status](https://api.travis-ci.org/zendframework/zf1.png?branch=
RELEASE INFORMATION
===================

Zend Framework 1.12.14dev Release.
Released on MMM DD, YYYY.
Zend Framework 1.12.15 Release.
Released on Aug 11, 2015.

IMPORTANT FIXES FOR 1.12.14
IMPORTANT FIXES FOR 1.12.15
---------------------------

This release contains a security fix:

- **ZF2015-06**: `ZendXml` runs a heuristic detection for XML Entity Expansion
and XML eXternal Entity vectors when under php-fpm, due to issues with threading
in libxml preventing using that library's built-in mechanisms for disabling
them. However, the heuristic was determined to be faulty when multibyte
encodings are used for the XML. This release contains a patch to ensure that the
heuristic will work with multibyte encodings.

If you use Zend Framework components that utilize DOMDocument or SimpleXML
(which includes `Zend\XmlRpc`, `Zend\Soap`, `Zend\Feed`, and several others),
and deploy using php-fpm in production (or plan to), we recommend upgrading
immediately.
This release contains several fixes that address backwards compatibility issues:

- [#591](https://github.com/zendframework/zf1/pull/591) adds PHP 5.2 support for
the [ZF2015-06](http://framework.zend.com/security/advisory/ZF2015-06)
security fix introduced in 1.12.14.
- [#587](https://github.com/zendframework/zf1/pull/587) fixes the regular
expression used to match a header in `Zend_Http_Response::extractHeaders()`
to ensure it allows any valid header name (previously, it failed with header
names that included `.` characters), as well as empty header values.
- [#597](https://github.com/zendframework/zf1/pull/597) updates
`Zend_Http_Client_Adapter_Curl` to properly distinguish between the `timeout`
configuration setting (which should map to `CURLOPT_CONNECTTIMEOUT` and/or
`CURLOPT_CONNECTTIMEOUT_MS`) and the `request_timeout` setting (which should
map to `CURLOPT_TIMEOUT` and/or `CURLOPT_TIMEOUT_MS`).

See http://framework.zend.com/changelog for full details.

Expand Down
2 changes: 1 addition & 1 deletion library/Zend/Version.php
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ final class Zend_Version
/**
* Zend Framework version identification - see compareVersion()
*/
const VERSION = '1.12.14dev';
const VERSION = '1.12.15';

/**
* The latest stable version Zend Framework available
Expand Down

0 comments on commit c7d193c

Please sign in to comment.