PHP 8.0.12 und 7.4.25 Security und Bugfix Release

Die Entwickler von PHP haben die Sicherheits und Bugfix Releases 8.0.12 und 7.4.25 veröffentlicht. PHP 8.0.12 behebt 17 und PHP 7.4.25 behebt 10 Fehler.

PHP 8.0.12 Release Notes

• CLI:
  • Fixed bug #81496 (Server logs incorrect request method).
• Core:
  • Fixed bug #81435 (Observer current_observed_frame may point to an old (overwritten) frame).
  • Fixed bug #81380 (Observer may not be initialized properly).
• DOM:
  • Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).
• FFI:
  • Fixed bug #79576 (“TYPE *” shows unhelpful message when type is not defined).
• FPM:
  • Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
• Fileinfo:
  • Fixed bug #78987 (High memory usage during encoding detection).
• Filter:
  • Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
• Opcache:
  • Fixed bug #81472 (Cannot support large linux major/minor device number when read /proc/self/maps).
• Reflection:
  • ReflectionAttribute is no longer final.
• SPL:
  • Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).
  • Fixed bug #81477 (LimitIterator + SplFileObject regression in 8.0.1).
• Standard:
  • Fixed bug #69751 (Change Error message of sprintf/printf for missing/typo position specifier).
• Streams:
  • Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).
• XML:
  • Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).
• Zip:
  • Fixed bug #81490 (ZipArchive::extractTo() may leak memory).
  • Fixed bug #77978 (Dirname ending in colon unzips to wrong dir).

Quelle: PHP: PHP 8 ChangeLog

PHP 7.4.25 Release Notes

• DOM:
  • Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).
• FFI:
  • Fixed bug #79576 (“TYPE *” shows unhelpful message when type is not defined).
• Fileinfo:
  • Fixed bug #78987 (High memory usage during encoding detection).
• Filter:
  • Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
• FPM:
  • Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
• SPL:
  • Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).
• Streams:
  • Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).
• XML:
  • Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).
• Zip:
  • Fixed bug #81490 (ZipArchive::extractTo() may leak memory).
  • Fixed bug #77978 (Dirname ending in colon unzips to wrong dir).

Quelle: PHP: PHP 7 ChangeLog