Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 0 down vote favorite

Please explain to me why Ubuntu 10.04 LTS Server version don't release the latest version of PHP. The PHP version is still in version 5.3.6-13 while the updated version is already at 5.3.10. Will this harm my server's security?

I want to update it to 5.3.10 but I don't know how to compile it properly. I am very confused in compiling php because there are so many configure options and i don't know where to start or which to choose. are there any tips on how to know what i need for the compile options?

i'm a server beginner please explain to me in layman's terms.. thank you so much for your time

share|improve this question
please see askubuntu.com/questions/72387/… – memical Mar 8 '12 at 22:00

1 Answer

up vote 1 down vote accepted

Because LTS versions are more focused on stability, PHP is not always updated to the latest source available on http://php.net. The idea is, if no new features are introduced, there are less chances of creating (security) bugs. However, if a security issue has been discovered, patches are applied.

The latest PHP version as of now in 10.04 Lucid is 5.3.2-1ubuntu4.14, where 11.10 Oneiric is 5.3.6-13ubuntu3.6. FYI, that is not a LTS version.

If you have no experience with building packages in this way, I suggest you not to compile your own packages because the Ubuntu packagers certainly know better the stuff than you.

For the configure options used, you can explore the debian/rules file which can be found in the source tree from apt-get source php5.

share|improve this answer
Oops, my mistake. I said my desktop version not my server version. Sorry. I got the source of php5 using your recommendation apt-get source php5. I got a lot of files here. Where can I find the ./configure --options here? My plan is to just copy the package's configure options and use it for my compiling process. is that possible? Thank you lekensteyn! – Raymond Feb 21 '12 at 10:13
If you're just going to duplicate the compile options, consider picking the sources from 12.04 Precise (in development). Download the .dsc, .diff.gz and .orig.gz files, install dpkg-dev and run dpkg-source -x php5_5.3.10-1ubuntu1.dsc && cd php5-5.3.10 && dpkg-buildpackage -b -uc -us. If you are asked to install missing dependencies, do so. Do not upgrade just because the version number is higher, if you don't miss any features, do risk installing newer versions which are not automatically updated. – Lekensteyn Feb 21 '12 at 10:34
Ok, I won't upgrade my PHP anymore. it seems like sticking to the repository is much safer option since you are warning me so much. Thank you lekensteyn! – Raymond Feb 21 '12 at 11:00
Keep track of Ubuntu Security Notices and keep your system updated with the repository :) Update and upgrade whenever there's any security notice for your system (well, unless the security notice says you're NOT supposed to update) and keep your system clean from hacking in your own versions. – sakjur Feb 21 '12 at 12:00
@Lekensteyn I agree that you should not upgrade just because the version number is higher, but what is not clear about the versioning system that ubuntu uses, is what security issues are patched. For example my version right now is 5.3.6-13ubuntu3.6, the latest PHP version is 5.3.11 and as far as I'm aware there are some nasty security issues between 5.3.6 and 5.3.11. Now the question is: What security issues have been patched in 5.3.6-13ubuntu3.6. The real issue, is that it isn't at all clear what security patches have been made. – BullfrogBlues Apr 30 '12 at 14:37
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.