PHP 5.4.36, 5.6.4 and 5.5.20 (CVEs)

[thaJeztah]

New releases, close some CVEs. I'm typing on my phone, but more info is on the php website.

ping @tianon (you were so fast fixing it last time)

[md5]

Looks like 5.5.20 is due to go out in docker-library/official-images#357, but not the 5.4.36 or 5.6.4 updates.

[thaJeztah]

Thanks for checking @md5; as said, typing on my phone right now, but saw the updates where released, so decided to quickly write an issue so that it could be fixed asap 😄

[tianon]

I don't know what you're talking about @md5; docker-library/official-images#357 clearly has those updates too. shifty eyes 🐍

[tianon]

... and of course, 5.4.36 fails to build; neato (although it looks like 5.5.20 is as well as 5.6.4, so this needs further investigation)

[md5]

Is it just me or are the lights in here getting dimmer...

[tianon]

I like where we're going with this. Close the door on PHP completely? 😄

[thaJeztah]

and of course, 5.4.36 fails to build

Well, the advantage of Docker; if it fails on your system, it will fail on my system as well. 😈

Close the door on PHP completely

Yeah, yeah.. we know. 😄

[tianon]

$ ./bashbrew/build.sh https://raw.githubusercontent.com/docker-library/official-images/2b1554cefb8b0a47ebc34b4eeccc5eaf9d9a1ef1/library/php
Processing php:5.4.36-cli ...
Processing php:5.4-cli ...
Processing php:5.4.36 ...
Processing php:5.4 ...
Processing php:5.4.36-apache ...
Processing php:5.4-apache ...
Processing php:5.4.36-fpm ...
Processing php:5.4-fpm ...
Processing php:5.5.20-cli ...
Processing php:5.5-cli ...
Processing php:5.5.20 ...
Processing php:5.5 ...
Processing php:5.5.20-apache ...
Processing php:5.5-apache ...
Processing php:5.5.20-fpm ...
# and still going ;)

[tianon]

(ie, I figured out the issue and the build test is going and going -- clearly way too much PHP)

[thaJeztah]

Clearly way too much PHP

The registry really needs a better UI for presenting all those tags as well. Also (looking at the page now), what does the date/time below "Properties" mean? It currently shows "2014-09-04 21:15:45", that's not the last build-date, which is downright confusing.

But that's a different topic.

Glad you worked out the problem and thanks for picking this up, @tianon

[yosifkit]

@thaJeztah, that looks like creation date, so it is not very helpful.

[thaJeztah]

@yosifkit yes, I'd gathered as much; and it's confusing, because it's easily interpreted as "last update" date (because it's so prominent), giving the impression that it's an outdated repository.

Anyway, just notes that are really off topic here 😄

[tianon]

This is fixed in master, merged in official-images, and currently building. 😉