[pkg-php-pear] Bug#886755: php-pear is missing PEAR5 class

[Loic Gomez]

Package: php-pear
Version: 5.6.33+dfsg-0+deb8u1
Severity: important

After updating php5 and php-pear from 5.6.30+dfsg-0+deb8u1 to 5.6.33+dfsg-0+deb8u1
on jessie, our application stopped working entirely with this error:

PHP Fatal error:  Class 'PEAR5' not found in /usr/share/php/DB/DataObject.php on line 4735

In order to compare versions, I fetched the source package for both and tried
installing pear with:

php5-source/pear$ php install-pear-nozlib.phar 

PHP 5.6.30+dfsg-0+deb8u1 is shipped with these versions:
[PEAR] Archive_Tar    - installed: 1.3.12 
[PEAR] Console_Getopt - installed: 1.3.1 
[PEAR] Structures_Graph- installed: 1.0.4 
[PEAR] XML_Util       - installed: 1.2.3 
[PEAR] PEAR           - installed: 1.9.5

PHP 5.6.33+dfsg-0+deb8u1 is shipped with these versions (and warnings):
[PEAR] Archive_Tar    - upgraded:  1.4.3
[PEAR] Console_Getopt - upgraded:  1.4.1
pear/pear dependency package "pear/Structures_Graph" downloaded version 1.1.1 is not the recommended version 1.0.4, but may be compatible, use --force to install
pear/Structures_Graph cannot be installed, conflicts with installed packages
[PEAR] Structures_Graph- upgraded:  1.1.1
pear/pear dependency package "pear/XML_Util" downloaded version 1.4.2 is not the recommended version 1.2.3, but may be compatible, use --force to install
pear/XML_Util cannot be installed, conflicts with installed packages
[PEAR] XML_Util       - upgraded:  1.4.2
[PEAR] PEAR           - upgraded:  1.10.5

In 5.6.30+dfsg-0+deb8u1, /usr/share/php/PEAR.php was including PEAR5.php but
now it doesn't anymore and PEAR5.php is removed.

I believe the security patch should have included pear version 1.9.5 too, or
is it considered insecure ?

Anyways, it's breaking our application (currently on our staging platform only).

Kind regards,
Loïc Gomez

-- System Information:
Debian Release: 8.10
  APT prefers oldstable
  APT policy: (990, 'oldstable'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages php-pear depends on:
ii  php5-cli     5.6.33+dfsg-0+deb8u1
ii  php5-common  5.6.33+dfsg-0+deb8u1

Versions of packages php-pear recommends:
ii  gnupg  1.4.18-7+deb8u3

Versions of packages php-pear suggests:
pn  php5-dev  <none>

-- no debconf information