Any chance you could try the CVS code?

cvs -d:pserver:cvsread@cvs.php.net:/repository co APC_3_0 pecl/apc

login pwd for the cvsread account is: phpfi

sorry.MY pc now in proxy.I don't understand how to try.

I will try to fix only CVE-2008-1488 to APC 3.0.16.

And I use at "apc.include_once_override  = 1"

Sorry  my bad english.

My immediate suspicion goes towards the url_stat() code.

Thanks for the bug, I'll trace through it on Monday.

I too am experiencing this bug. It only affects my PHP 4.3.10 and 4.4.4 installations (Debian Etch AMD64); PHP 5.2.0 does NOT seem to be affected.

Thanks,
Mike

try 

wget "http://cvsweb.php.net/viewvc.cgi/pecl/apc/apc_main.c?r1=3.107&r2=3.108&view=patch"  -O kludge.patch

patch -R < kludge.patch

on 3.0.18 (and yeah, one line won't patch right - ignore)

Confirm, please.

Hi gopalv,

I tested your patch with a PHP 4.4.4 server against 3.0.18. It compiled fine, but unfortunately PHP pages start returning blank, and the Apache error log starts filling with these line:

[Mon Mar 31 15:38:29 2008] [notice] child pid 18615 exit signal Segmentation fault (11)

Regards,
Mike

Thanks gopalv. But me too,this err.

  child pid 19479 exit signal Segmentation fault (11)

I saw diff and think 

At 3 line  before "zend_llist_add_element"

<old OK 3.0.16>
h->opened_path = estrdup(cache_entry->data.file.filename);

<BAD 3.0.18 >
h->opened_path = cache_entry->data.file.filename;

I don't understand this difference,but I think that it become the clue.

I'm sorry in clumsy English.
(Powered by Yahoo Translation...)

Using APC-2.0.17 (with PHP 5.2.5), I'm suffering the same problems as this user, but on CentOS 5. I see on my Apache error log a lot of these messages:
------
[warn-phpd] mmap cache can't open /var/www/html/foo.php - Too many open files in system (pid 1694)
-------

I increased the value max open files, by modifying '/etc/security/limits.conf' file (see http://lists.centos.org/pipermail/centos/2005-February/045072.html), but still getting those error messages and white pages.

I'm triyng to install v2.0.18 with the patch you suggest but got this message:
-----------
[]# wget "http://cvsweb.php.net/viewvc.cgi/pecl/apc/apc_main.c?r1=3.107&r2=3.108&view=patch"
-O kludge.patch
[]# patch -R < kludge.patch
patching file apc_main.c
Hunk #1 FAILED at 28.
Hunk #2 succeeded at 280 (offset 38 lines).
Hunk #3 succeeded at 315 with fuzz 1 (offset 2 lines).
1 out of 3 hunks FAILED -- saving rejects to file apc_main.c.rej
------------

and I don't know if I must continue or not. Any suggestion is welcome.

I tried to install APC 3.0.18 (without the Patch) on a Fedora Core server which was running ol APC 3.0.10 and got this error message in a few seconds:
------
Too many open files in system
---------

I've been running out of file handles with 3.0.17 and .18. Didn't notice immediately, but when phpMyAdmin stopped working, I checked the apache server log and found numerous errors as follows:

(24)Too many open files: /home/physics/web-docs/.htaccess pcfg_openfile:

I checked the available file handles, and the system has plenty to spare. The most use on the system is 5634 out of 
a maximum of 16384.

I've gone back to APC 3.0.16, and the problems have stopped.

The newer versions (.0.17-.18) seem to have fixed the errors  described in #12956, but those errors don't cause pages to not be served, while this latest problem causes the server to stop serving pages, at least within a particular apache process.

Installed versions:

Apache/2.0.63 (Unix) and PHP/4.4.8

I've also experienced this same issue under CentOS 4.6, Apache 1.3.39, PHP 4.4.7, APC 3.0.18.

Raising file-max with sysctl or restarting Apache provide temporary relief.

The patch suggested by gopalv resulted in the following:
patching file apc_main.c
Hunk #1 FAILED at 28.
Hunk #2 succeeded at 280 (offset 38 lines).
Hunk #3 succeeded at 315 with fuzz 1 (offset 2 lines).
1 out of 3 hunks FAILED -- saving rejects to file apc_main.c.rej

Thanks gopalv.

apc_main.c Revision 3.103.2.5  with APC 3.0.18
it seems to be good for my PHP4 Server.

Same problem on CentOS 5, PHP 5.1.6 and APC 3.0.18. Nightmare!

Same problem with CentOS 4 and PHP4

Same problem with Debian Etch, Kernel 2.6.18, Php 4.4.4, Apache 2.2.3

I saw same problem with APC.
the enviroment is bellow.

Debian-sarge 32bit
PHP4.3.11
APC3.0.18(pthread mutex)

and another problem with PHP5.
PHP outputs warnings under safe_mode.
it seemd PHP try to read multi files,on include_path contains multiple paths.

I am waiting APC3.0.19 for a month.
there is some reason that 3.0.19 couldn't out ?

These issues are fixed in CVS.  3.0.19 is coming shortly.  Grab the current APC_3_0 branch if you are impatient.