Published date: 2025-01-10 | Updated date: 2025-01-11 | Neustradamus

Should we use?
XAMPP

Apache + MariaDB + PHP + Perl

Linux / Apple MacOS / Microsoft Windows

Development use?
Production use?

Apache Friends

XAMPP, what is it?

XAMPP is a free and open-source cross-platform web server solution stack package developed by Apache Friends, consisting mainly of the Apache HTTP Server, MariaDB database, and interpreters for scripts written in the PHP and Perl programming languages.
Since most actual web server deployments use the same components as XAMPP, it makes transitioning from a local test server to a live server possible.

The Apache Friends website indicates that XAMPP stands for "XAMPP Apache + MariaDB + PHP + Perl", making it a recursive acronym. XAMPP formerly used MySQL, but this was replaced with MariaDB on 19 October 2015 and beginning with XAMPP versions 5.5.30 and 5.6.14, altering the meaning of the acronym. It originally stood for Cross-Platform + Apache + MySQL + PHP + Perl.

Source: Wikipedia

Important informations, a little history...

XAMPP and Apache Friends have been created by Kai "Oswald" Seidler and Kay Vogelgesang in 2002.
In 2013, Apache Friends has been acquired by Bitrock, creator of Bitnami.
In 2019, Bitrock has been acquired by VMware.
In 2022, Bitrock has been acquired by Backstaff Software without Bitnami.
In 2023, VMware has been acquired by Broadcom.

Updates?

Badly, since several years ago, there were little updates of XAMPP, it was already not good.
And nothing since 2023 after the sale of VMware.

Development use or Production use or boths?

Since 2002, XAMPP is used in development as well as in production on internal, external, and cloud machines. Attention: If it is not very often updated, there is no security.

Download statistics?

On Sourceforge:

It is only Sourceforge, there are not external download statistics.

Latest Apache Friends Announcement (2023-11-19)

https://www.apachefriends.org/blog/new_xampp_20231119.html

Vulnerabilities

Some CVEs have been solved in latest used software versions
XAMPP has not up-to-date latest software versions

XAMPP

Apache HTTPd

MariaDB (10.4.x: EOL)

PHP (8.0.x and 8.1.x: EOL)

Apache mod_perl, Perl and StrawberryPerl

Apache Tomcat (8.5.x: EOL)

phpMyAdmin

FileZilla Server

Mercury Mail Transport System

OpenSSL (1.1.1: EOL / 3.1.x EOL Q1 2025)

Curl

Apache Portable Runtime - APR

https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-18195/Apache-APR.html

Apache Portable Runtime Utility Library - APR-utils

https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-17508/Apache-Apr-util.html

FPDF

Not listed (no vulnerability?)

FreeTDS

https://www.cvedetails.com/vulnerability-list/vendor_id-22202/Freetds.html

FreeType

https://www.cvedetails.com/vulnerability-list/vendor_id-4535/Freetype.html

LibGD

https://www.cvedetails.com/vulnerability-list/vendor_id-6668/Libgd.html

GNU dbm

Not listed (no vulnerability?)

gettext

https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-4701/GNU-Gettext.html

ICU4C

UW IMAP

Not listed (no vulnerability?)

Apache HTTP Request Library - apreq

Expat - libexpat

libpng

libxml

libxslt

https://www.cvedetails.com/vulnerability-list/vendor_id-1962/product_id-14676/Xmlsoft-Libxslt.html

mcrypt

https://www.cvedetails.com/vulnerability-list/vendor_id-1643/Mcrypt.html

mhash

Not listed (no vulnerability?)

R&OS Pdf Class

Not listed (no vulnerability?)

ProFTPD

Sablotron

Not listed (no vulnerability?)

zlib

https://www.cvedetails.com/vulnerability-list/vendor_id-13265/product_id-111843/Zlib-Zlib.html

References

Softwares

Companies

Bitnami on Wikipedia | Official website: https://bitnami.com/
VMware on Wikipedia | Official website: https://www.vmware.com/
Broadcom on Wikipedia | Official website: https://www.broadcom.com/

Solutions

Look another? on Wikipedia
LAMP on Wikipedia

Author of this security alert

	Neustradamus
Fediverse/Mastodon	neustradamus@mastodon.social
AT Protocol/Bluesky	neustradamus.bsky.social
X/Twitter	Neustradamus
Reddit	Neustradamus
Hacker News	Neustradamus

Published date: 2025-01-10 | Updated date: 2025-01-11 | Neustradamus

Neustradamus/xampp

ErrorLooks like something went wrong!

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Error
Looks like something went wrong!

Packages