Die Entwickler von PHP haben heute Sicherheitsupdates für die PHP Zweige 8.1., 8.2, 8.3 und 8.4 veröffentlicht. Die Updates schließen Lücken die in den folgenden CVEs beschrieben sind: CVE-2025-1219, CVE-2025-1736, CVE-2025-1861, CVE-2025-1734 and CVE-2025-1217.
PHP 8.4.5 Release Notes
- BCMath:
- Core:
- Fixed bug GH-17623 (Broken stack overflow detection for variable compilation).
- Fixed bug GH-17618 (UnhandledMatchError does not take zend.exception_ignore_args=1 into account).
- Fix fallback paths in fast_long_{add,sub}_function.
- Fixed bug OSS-Fuzz #391975641 (Crash when accessing property backing value by reference).
- Fixed bug GH-17718 (Calling static methods on an interface that has `__callStatic` is allowed).
- Fixed bug GH-17713 (ReflectionProperty::getRawValue() and related methods may call hooks of overridden properties).
- Fixed bug GH-17916 (Final abstract properties should error).
- Fixed bug GH-17866 (zend_mm_heap corrupted error after upgrading from 8.4.3 to 8.4.4).
- Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)
- DOM:
- GD:
- FFI:
- Fix FFI Parsing of Pointer Declaration Lists.
- FPM:
- Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env).
- LDAP:
- Fixed bug GH-17704 (ldap_search fails when $attributes contains a non-packed array with numerical keys).
- LibXML:
- Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714).
- Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
- MBString:
- Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).
- Opcache:
- Fixed bug GH-17654 (Multiple classes using same trait causes function JIT crash).
- Fixed bug GH-17577 (JIT packed type guard crash).
- Fixed bug GH-17747 (Exception on reading property in register-based FETCH_OBJ_R breaks JIT).
- Fixed bug GH-17715 (Null pointer deref in observer API when calling cases() method on preloaded enum).
- Fixed bug GH-17868 (Cannot allocate memory with tracing JIT on 8.4.4).
- PDO_SQLite:
- Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults).
- Fix cycle leak in sqlite3 setAuthorizer().
- Fix memory leaks in pdo_sqlite callback registration.
- Phar:
- Fixed bug GH-17808: PharFileInfo refcount bug.
- PHPDBG:
- Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer).
- Fix memory leak in phpdbg calling registered function.
- Reflection:
- Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).
- Fixed missing final and abstract flags when dumping properties.
- Standard:
- Fixed bug #72666 (stat cache clearing inconsistent between file:// paths and plain paths).
- Streams:
- Fixed bug GH-17650 (realloc with size 0 in user_filters.c).
- Fix memory leak on overflow in _php_stream_scandir().
- Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
- Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
- Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
- Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
- Windows:
- Fixed phpize for Windows 11 (24H2).
- Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).
- Zlib:
- Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
- Fix memory leak when encoding check fails.
- Fix zlib support for large files.
PHP 8.3.19 Release Notes
- BCMath:
- Core:
- Fixed bug GH-17623 (Broken stack overflow detection for variable compilation).
- Fixed bug GH-17618 (UnhandledMatchError does not take zend.exception_ignore_args=1 into account).
- Fix fallback paths in fast_long_{add,sub}_function.
- Fixed bug GH-17718 (Calling static methods on an interface that has `__callStatic` is allowed).
- Fixed bug GH-17797 (zend_test_compile_string crash on invalid script path).
- Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)
- DOM:
- Fixed bug GH-17847 (xinclude destroys live node).
- FFI:
- Fix FFI Parsing of Pointer Declaration Lists.
- FPM:
- Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env).
- GD:
- Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M).
- LDAP:
- Fixed bug GH-17704 (ldap_search fails when $attributes contains a non-packed array with numerical keys).
- LibXML:
- Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714).
- Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
- MBString:
- Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).
- Opcache:
- PDO_SQLite:
- Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults).
- Fix cycle leak in sqlite3 setAuthorizer().
- Phar:
- Fixed bug GH-17808: PharFileInfo refcount bug.
- PHPDBG:
- Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer).
- Fix memory leak in phpdbg calling registered function.
- Reflection:
- Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).
- Standard:
- Fixed bug #72666 (stat cache clearing inconsistent between file:// paths and plain paths).
- Streams:
- Fixed bug GH-17650 (realloc with size 0 in user_filters.c).
- Fix memory leak on overflow in _php_stream_scandir().
- Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
- Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
- Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
- Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
- Windows:
- Fixed phpize for Windows 11 (24H2).
- Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).
- Zlib:
- Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
- Fix memory leak when encoding check fails.
- Fix zlib support for large files.
PHP 8.2.28 Release Notes
- Core:
- LibXML:
- Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714).
- Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
- Streams:
- Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
- Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
- Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
- Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
- Windows:
- Fixed phpize for Windows 11 (24H2).
PHP 8.1.32 Release Notes
- LibXML:
- Streams:
- Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
- Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
- Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
- Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
- Windows:
- Fixed phpize for Windows 11 (24H2).
Interessiert in verschiedenste IT Themen, schreibe ich in diesem Blog über Software, Hardware, Smart Home, Games und vieles mehr. Ich berichte z.B. über die Installation und Konfiguration von Software als auch von Problemen mit dieser. News sind ebenso spannend, sodass ich auch über Updates, Releases und Neuigkeiten aus der IT berichte. Letztendlich nutze ich Taste-of-IT als eigene Dokumentation und Anlaufstelle bei wiederkehrenden Themen. Ich hoffe ich kann dich ebenso informieren und bei Problemen eine schnelle Lösung anbieten. Wer meinen Aufwand unterstützen möchte, kann gerne eine Tasse oder Pod Kaffe per PayPal spenden – vielen Dank.