Menü Schließen

PHP Security Relase 8.1.32 – 8.2.28 – 8.3.19 und 8.4.5 veröffentlicht

JARVIS 0 Kommentare
PHP Logo

Die Entwickler von PHP haben heute Sicherheitsupdates für die PHP Zweige 8.1., 8.2, 8.3 und 8.4 veröffentlicht. Die Updates schließen Lücken die in den folgenden CVEs beschrieben sind: CVE-2025-1219, CVE-2025-1736, CVE-2025-1861, CVE-2025-1734 and CVE-2025-1217.

Inhalte Verbergen
1 PHP 8.4.5 Release Notes
2 PHP 8.3.19 Release Notes
3 PHP 8.2.28 Release Notes
4 PHP 8.1.32 Release Notes

PHP 8.4.5 Release Notes

  • BCMath:
  • Core:
    • Fixed bug GH-17623 (Broken stack overflow detection for variable compilation).
    • Fixed bug GH-17618 (UnhandledMatchError does not take zend.exception_ignore_args=1 into account).
    • Fix fallback paths in fast_long_{add,sub}_function.
    • Fixed bug OSS-Fuzz #391975641 (Crash when accessing property backing value by reference).
    • Fixed bug GH-17718 (Calling static methods on an interface that has `__callStatic` is allowed).
    • Fixed bug GH-17713 (ReflectionProperty::getRawValue() and related methods may call hooks of overridden properties).
    • Fixed bug GH-17916 (Final abstract properties should error).
    • Fixed bug GH-17866 (zend_mm_heap corrupted error after upgrading from 8.4.3 to 8.4.4).
    • Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)
  • DOM:
    • Fixed bug GH-17609 (Typo in error message: Dom\NO_DEFAULT_NS instead of Dom\HTML_NO_DEFAULT_NS).
    • Fixed bug GH-17802 (\Dom\HTMLDocument querySelector attribute name is case sensitive in HTML).
    • Fixed bug GH-17847 (xinclude destroys live node).
    • Fix using Dom\Node with Dom\XPath callbacks.
  • GD:
    • Fixed bug GH-17703 (imagescale with both width and height negative values triggers only an Exception on width).
    • Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M).
  • FFI:
    • Fix FFI Parsing of Pointer Declaration Lists.
  • FPM:
    • Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env).
  • LDAP:
    • Fixed bug GH-17704 (ldap_search fails when $attributes contains a non-packed array with numerical keys).
  • LibXML:
  • MBString:
    • Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).
  • Opcache:
    • Fixed bug GH-17654 (Multiple classes using same trait causes function JIT crash).
    • Fixed bug GH-17577 (JIT packed type guard crash).
    • Fixed bug GH-17747 (Exception on reading property in register-based FETCH_OBJ_R breaks JIT).
    • Fixed bug GH-17715 (Null pointer deref in observer API when calling cases() method on preloaded enum).
    • Fixed bug GH-17868 (Cannot allocate memory with tracing JIT on 8.4.4).
  • PDO_SQLite:
    • Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults).
    • Fix cycle leak in sqlite3 setAuthorizer().
    • Fix memory leaks in pdo_sqlite callback registration.
  • Phar:
    • Fixed bug GH-17808: PharFileInfo refcount bug.
  • PHPDBG:
    • Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer).
    • Fix memory leak in phpdbg calling registered function.
  • Reflection:
    • Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).
    • Fixed missing final and abstract flags when dumping properties.
  • Standard:
    • Fixed bug #72666 (stat cache clearing inconsistent between file:// paths and plain paths).
  • Streams:
    • Fixed bug GH-17650 (realloc with size 0 in user_filters.c).
    • Fix memory leak on overflow in _php_stream_scandir().
    • Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
    • Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
    • Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
    • Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
  • Windows:
    • Fixed phpize for Windows 11 (24H2).
    • Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).
  • Zlib:
    • Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
    • Fix memory leak when encoding check fails.
    • Fix zlib support for large files.

PHP 8.3.19 Release Notes

  • BCMath:
  • Core:
    • Fixed bug GH-17623 (Broken stack overflow detection for variable compilation).
    • Fixed bug GH-17618 (UnhandledMatchError does not take zend.exception_ignore_args=1 into account).
    • Fix fallback paths in fast_long_{add,sub}_function.
    • Fixed bug GH-17718 (Calling static methods on an interface that has `__callStatic` is allowed).
    • Fixed bug GH-17797 (zend_test_compile_string crash on invalid script path).
    • Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)
  • DOM:
    • Fixed bug GH-17847 (xinclude destroys live node).
  • FFI:
    • Fix FFI Parsing of Pointer Declaration Lists.
  • FPM:
    • Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env).
  • GD:
    • Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M).
  • LDAP:
    • Fixed bug GH-17704 (ldap_search fails when $attributes contains a non-packed array with numerical keys).
  • LibXML:
  • MBString:
    • Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).
  • Opcache:
    • Fixed bug GH-17654 (Multiple classes using same trait causes function JIT crash).
    • Fixed bug GH-17577 (JIT packed type guard crash).
    • Fixed bug GH-17899 (zend_test_compile_string with invalid path when opcache is enabled).
    • Fixed bug GH-17868 (Cannot allocate memory with tracing JIT).
  • PDO_SQLite:
    • Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults).
    • Fix cycle leak in sqlite3 setAuthorizer().
  • Phar:
    • Fixed bug GH-17808: PharFileInfo refcount bug.
  • PHPDBG:
    • Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer).
    • Fix memory leak in phpdbg calling registered function.
  • Reflection:
    • Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).
  • Standard:
    • Fixed bug #72666 (stat cache clearing inconsistent between file:// paths and plain paths).
  • Streams:
    • Fixed bug GH-17650 (realloc with size 0 in user_filters.c).
    • Fix memory leak on overflow in _php_stream_scandir().
    • Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
    • Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
    • Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
    • Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
  • Windows:
    • Fixed phpize for Windows 11 (24H2).
    • Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).
  • Zlib:
    • Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
    • Fix memory leak when encoding check fails.
    • Fix zlib support for large files.

PHP 8.2.28 Release Notes

  • Core:
  • LibXML:
  • Streams:
    • Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
    • Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
    • Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
    • Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
  • Windows:
    • Fixed phpize for Windows 11 (24H2).

PHP 8.1.32 Release Notes

  • LibXML:
  • Streams:
    • Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
    • Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
    • Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
    • Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
  • Windows:
    • Fixed phpize for Windows 11 (24H2).

Verschlagwortet , , , , , , , , , ,

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert