Changed

• The application log was moved from the app directory to the temporary directory, for example, /tmp/ZendHQ/zendhq-ui.log
• Fixed logging in case system temp directory is unknown
• Updated the AgGrid component to version 32

Fixes

• Fixes display of custom event data in the Monitoring event details view. Data is now displayed in a tree view to prevent truncation, and each item can be individually selected into the system clipboard.

Changed

• Fixes a crash when triggering a browser refresh

• Adds an MSI installer for Windows

Fixed

• Fixes issues on Windows where the application would not close.

August 29, 2024

Community Fixes

PHP version 8.3.11 fixes

• Core

  • Fixed bug GH-15020: Memory leak in Zend/Optimizer/escape_analysis.c
  • Fixed bug GH-15023: Memory leak in Zend/zend_ini.c
  • Fixed bug GH-13330: Append -Wno-implicit-fallthrough flag conditionally
  • Fix uninitialized memory in network.c
  • Fixed bug GH-15108: Segfault when destroying generator during shutdown
  • Fixed bug GH-15275: Crash during GC of suspended generator delegate

• Curl

  • Fixed case when curl_error returns an empty string

• DOM

  • Fix UAF when removing doctype and using foreach iteration

• FFI

  • Fixed bug GH-14286: ffi enum type (when enum has no name) make memory leak

• Hash

  • Fix crash when converting array data for array in shm in xxh3

• Intl

  • Fixed bug GH-15087: IntlChar::foldCase()'s $option is not optional

• Opcache

  • Fixed bug GH-13817: Segmentation fault for enabled observers after pass 4
  • Fixed bug GH-13775: Memory leak possibly related to opcache SHM placement

• Output

  • Fixed bug GH-15179: Segmentation fault (null pointer dereference) in ext/standard/url_scanner_ex.re

• PDO_Firebird

  • Fix bogus fallthrough path in firebird_handle_get_attribute()

• PHPDBG

  • Fixed bug GH-13199: EOF emits redundant prompt in phpdbg local console mode with libedit/readline
  • Fixed bug GH-15268: heap buffer overflow in phpdbg (zend_hash_num_elements() Zend/zend_hash.h)
  • Fixed bug GH-15210: use-after-free on watchpoint allocations

• Random

  • Fixed part of bug GH-15381, checking getrandom availability on solaris

• Soap

  • Fixed bug #55639: Digest autentication dont work
  • Fix SoapFault property destruction
  • Fixed bug GH-15252: SOAP XML broken since PHP 8.3.9 when using classmap constructor option

• Standard

  • Fix passing non-finite timeout values in stream functions
  • Fixed GH-14780: p(f)sockopen timeout overflow

• Streams

  • Fixed bug GH-15028: Memory leak in ext/phar/stream.c
  • Fixed bug GH-15034: Integer overflow on stream_notification_callback byte_max parameter with files bigger than 2GB
  • Reverted fix for GH-14930: Custom stream wrapper dir_readdir output truncated to 255 characters

• Tidy

  • Fix memory leaks in ext/tidy basedir restriction code

PHP version 8.2.23 fixes

• Core

  • Fixed bug GH-15020: Memory leak in Zend/Optimizer/escape_analysis.c
  • Fixed bug GH-15023: Memory leak in Zend/zend_ini.c
  • Fixed bug GH-13330: Append -Wno-implicit-fallthrough flag conditionally
  • Fix uninitialized memory in network.c
  • Fixed bug GH-15108: Segfault when destroying generator during shutdown
  • Fixed bug GH-15275: Crash during GC of suspended generator delegate

• Curl

  • Fixed case when curl_error returns an empty string

• DOM

  • Fix UAF when removing doctype and using foreach iteration

• FFI

  • Fixed bug GH-14286: ffi enum type (when enum has no name) make memory leak

• Hash

  • Fix crash when converting array data for array in shm in xxh3

• Intl

  • Fixed bug GH-15087: IntlChar::foldCase()'s $option is not optional

• Opcache

  • Fixed bug GH-13817: Segmentation fault for enabled observers after pass 4
  • Fixed bug GH-13775: Memory leak possibly related to opcache SHM placement

• Output

  • Fixed bug GH-15179: Segmentation fault (null pointer dereference) in ext/standard/url_scanner_ex.re

• PDO_Firebird

  • Fix bogus fallthrough path in firebird_handle_get_attribute()

• PHPDBG

  • Fixed bug GH-13199: EOF emits redundant prompt in phpdbg local console mode with libedit/readline
  • Fixed bug GH-15268: heap buffer overflow in phpdbg (zend_hash_num_elements() Zend/zend_hash.h)
  • Fixed bug GH-15210: use-after-free on watchpoint allocations

• Random

  • Fixed part of bug GH-15381, checking getrandom availability on solaris

• Soap

  • Fixed bug #55639: Digest autentication dont work
  • Fix SoapFault property destruction
  • Fixed bug GH-15252: SOAP XML broken since PHP 8.3.9 when using classmap constructor option

• Standard

  • Fix passing non-finite timeout values in stream functions
  • Fixed GH-14780: p(f)sockopen timeout overflow

• Streams

  • Fixed bug GH-15028: Memory leak in ext/phar/stream.c
  • Fixed bug GH-15034: Integer overflow on stream_notification_callback byte_max parameter with files bigger than 2GB

• Tidy

  • Fix memory leaks in ext/tidy basedir restriction code

August 5, 2024

Community Fixes

PHP version 8.3.10 fixes

• Core

  • Fixed bug GH-13922: Fixed support for systems with sysconf(_SC_GETPW_R_SIZE_MAX) == -1.
  • Fixed bug GH-14626: Fix is_zend_ptr() for huge blocks.
  • Fixed bug GH-14590: Memory leak in FPM test gh13563-conf-bool-env.phpt.
  • Fixed OSS-Fuzz #69765.
  • Fixed bug GH-14741: Segmentation fault in Zend/zend_types.h.
  • Fixed bug GH-14969: Use-after-free in property coercion with __toString().
  • Fixed bug GH-14961: Comment between -> and keyword results in parse error.

• Dom

  • Fixed bug GH-14702: DOMDocument::xinclude() crash.

• Fileinfo

  • Fixed bug GH-14888: README.REDIST.BINS refers to non-existing LICENSE.

• Gd

  • ext/gd/tests/gh10614.phpt: skip if no PNG support.
  • restored warning instead of fata error.

• LibXML

  • Fixed bug GH-14563: Build failure with libxml2 v2.13.0.

• Opcache

  • Fixed bug GH-14550: No warning message when Zend DTrace is enabled that opcache.jit is implictly disabled.

• Output

  • Fixed bug GH-14808: Unexpected null pointer in Zend/zend_string.h with empty output buffer.

• PDO

  • Fixed bug GH-14712: Crash with PDORow access to null property.

• Phar

  • Fixed bug GH-14603: null string from zip entry.

• PHPDBG

  • Fixed bug GH-14596: crashes with ASAN and ZEND_RC_DEBUG=1.
  • Fixed bug GH-14553: echo output trimmed at NULL byte.

• Shmop

  • Fixed bug GH-14537: shmop Windows 11 crashes the process.

• SPL

  • Fixed bug GH-14639: Member access within null pointer in ext/spl/spl_observer.c.

• Standard

  • Fix 32-bit wordwrap test failures.
  • Fixed bug GH-14774: time_sleep_until overflow.
  • Fixed bug GH-14775: range function overflow with negative step argument.

• Streams

  • Fixed bug GH-14930: Custom stream wrapper dir_readdir output truncated to 255 characters in PHP 8.3.

• Tidy

  • Fix memory leak in tidy_repair_file().

• Treewide

  • Fix compatibility with libxml2 2.13.2.

• XML

  • Move away from to-be-deprecated libxml fields.
  • Fixed bug GH-14834: Error installing PHP when --with-pear is used.

PHP version 8.2.22 fixes

• SimpleXML

  • Fixed bug GH-14638: null dereference after XML parsing failure.

• Core

  • Fixed bug GH-13922: Fixed support for systems with sysconf(_SC_GETPW_R_SIZE_MAX) == -1.
  • Fixed bug GH-14626: Fix is_zend_ptr() for huge blocks.
  • Fixed bug GH-14590: Memory leak in FPM test gh13563-conf-bool-env.phpt.
  • Fixed OSS-Fuzz #69765.
  • Fixed bug GH-14741: Segmentation fault in Zend/zend_types.h.
  • Fixed bug GH-14969: Use-after-free in property coercion with __toString().
  • Fixed bug GH-14961: Comment between -> and keyword results in parse error.

• Dom

  • Fixed bug GH-14702: DOMDocument::xinclude() crash.

• Gd

  • ext/gd/tests/gh10614.phpt: skip if no PNG support.
  • restored warning instead of fata error.

• LibXML

  • Fixed bug GH-14563: Build failure with libxml2 v2.13.0.

• Opcache

  • Fixed bug GH-14550: No warning message when Zend DTrace is enabled that opcache.jit is implictly disabled.

• Output

  • Fixed bug GH-14808: Unexpected null pointer in Zend/zend_string.h with empty output buffer.

• PDO

  • Fixed bug GH-14712: Crash with PDORow access to null property.

• Phar

  • Fixed bug GH-14603: null string from zip entry.

• PHPDBG

  • Fixed bug GH-14596: crashes with ASAN and ZEND_RC_DEBUG=1.
  • Fixed bug GH-14553: echo output trimmed at NULL byte.

• Shmop

  • Fixed bug GH-14537: shmop Windows 11 crashes the process.

• SPL

  • Fixed bug GH-14639: Member access within null pointer in ext/spl/spl_observer.c.

• Standard

  • Fix 32-bit wordwrap test failures.
  • Fixed bug GH-14774: time_sleep_until overflow.

• Tidy

  • Fix memory leak in tidy_repair_file().

• Treewide

  • Fix compatibility with libxml2 2.13.2.

• XML

  • Move away from to-be-deprecated libxml fields.
  • Fixed bug GH-14834: Error installing PHP when --with-pear is used.

Community Fixes

PHP version 8.3.13 fixes

• Calendar

  • Fixed GH-16240: jdtounix overflow on argument value.
  • Fixed GH-16241: easter_days/easter_date overflow on year argument.
  • Fixed GH-16263: jddayofweek overflow.
  • Fixed GH-16234: jewishtojd overflow.

• CLI

  • Fixed bug GH-16137: duplicate http headers when set several times by the client.

• Core

  • Fixed bug GH-16054: Segmentation fault when resizing hash table iterator list while adding.
  • Fixed bug GH-15905: Assertion failure for TRACK_VARS_SERVER.
  • Fixed bug GH-15907: Failed assertion when promoting Serialize deprecation to exception.
  • Fixed bug GH-15851: Segfault when printing backtrace during cleanup of nested generator frame.
  • Fixed bug GH-15866: Core dumped in Zend/zend_generators.c.
  • Fixed bug GH-16188: Assertion failure in Zend/zend_exceptions.c.
  • Fixed bug GH-16233: Observer segfault when calling user function in internal function via trampoline.

• DOM

  • Fixed bug GH-16039: Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c.
  • Fixed bug GH-16149: Null pointer dereference in DOMElement->getAttributeNames().
  • Fixed bug GH-16151: Assertion failure in ext/dom/parentnode/tree.c.
  • Fixed bug GH-16150: Use after free in php_dom.c.
  • Fixed bug GH-16152: Memory leak in DOMProcessingInstruction/DOMDocument.

• JSON

  • Fixed bug GH-15168: stack overflow in json_encode().

• GD

  • Fixed bug GH-16232: bitshift overflow on wbmp file content reading / fix backport from upstream.
  • Fixed bug GH-12264: overflow/underflow on imagerotate degrees value
  • Fixed bug GH-16274: imagescale underflow on RBG channels / fix backport from upstream.

• LDAP

  • Fixed bug GH-16032: Various NULL pointer dereferencements in ldap_modify_batch().
  • Fixed bug GH-16101: Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list.
  • Fix GH-16132: php_ldap_do_modify() attempts to free pointer not allocated by ZMM.
  • Fix GH-16136: Memory leak in php_ldap_do_modify() when entry is not a proper dictionary.

• MBString

  • Fixed bug GH-16261: Reference invariant broken in mb_convert_variables().

• OpenSSL

  • Fixed stub for openssl_csr_new.

• PCRE

  • Fixed bug GH-16189: underflow on offset argument.
  • Fixed bug GH-16184: UBSan address overflowed in ext/pcre/php_pcre.c.

• PHPDBG

  • Fixed bug GH-15901: phpdbg: Assertion failure on i funcs.
  • Fixed bug GH-16181: phpdbg: exit in exception handler reports fatal error.

• Reflection

  • Fixed bug GH-16187: Assertion failure in ext/reflection/php_reflection.c.

• SAPI

  • Fixed bug GH-15395: php-fpm: zend_mm_heap corrupted with cgi-fcgi request.

• SimpleXML

  • Fixed bug GH-15837: Segmentation fault in ext/simplexml/simplexml.c.

• Sockets

  • Fixed bug GH-16267: socket_strerror overflow on errno argument.

• SOAP

  • Fixed bug #73182: PHP SOAPClient does not support stream context HTTP headers in array form.
  • Fixed bug #62900: Wrong namespace on xsd import error message.
  • Fixed bug GH-15711: SoapClient can't convert BackedEnum to scalar value.
  • Fixed bug GH-16237: Segmentation fault when cloning SoapServer.
  • Fix Soap leaking http_msg on error.
  • Fixed bug GH-16256: Assertion failure in ext/soap/php_encoding.c:460.
  • Fixed bug GH-16259: Soap segfault when classmap instantiation fails.

• SPL

  • Fixed bug GH-15918: Assertion failure in ext/spl/spl_fixedarray.c.

• Standard

  • Fixed bug GH-16053: Assertion failure in Zend/zend_hash.c.
  • Fixed bug GH-15169: stack overflow when var serialization in ext/standard/var.

• Streams

  • Fixed bugs GH-15908 and GH-15026: leak / assertion failure in streams.c.
  • Fixed bug GH-15980: Signed integer overflow in main/streams/streams.c.

• TSRM

  • Prevent closing of unrelated handles.

• Windows

  • Fixed minimal Windows version.

PHP version 8.2.25 fixes

• Calendar

  • Fixed GH-16240: jdtounix overflow on argument value.
  • Fixed GH-16241: easter_days/easter_date overflow on year argument.
  • Fixed GH-16263: jddayofweek overflow.
  • Fixed GH-16234: jewishtojd overflow.

• CLI

  • Fixed bug GH-16137: duplicate http headers when set several times by the client.

• Core

  • Fixed bug GH-15712: zend_strtod overflow with precision INI set on large value.
  • Fixed bug GH-15905: Assertion failure for TRACK_VARS_SERVER.
  • Fixed bug GH-15907: Failed assertion when promoting Serialize deprecation to exception.
  • Fixed bug GH-15851: Segfault when printing backtrace during cleanup of nested generator frame.
  • Fixed bug GH-15866: Core dumped in Zend/zend_generators.c.
  • Fixed bug GH-16188: Assertion failure in Zend/zend_exceptions.c.
  • Fixed bug GH-16233: Observer segfault when calling user function in internal function via trampoline.

• Date

  • Fixed bug GH-15582: Crash when not calling parent constructor of DateTimeZone.
  • Fixed regression where signs after the first one were ignored while parsing a signed integer, with the DateTimeInterface::modify() function.

• DOM

  • Fixed bug GH-16039: Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c.
  • Fixed bug GH-16151: Assertion failure in ext/dom/parentnode/tree.c.

• GD

  • Fixed bug GH-16232: bitshift overflow on wbmp file content reading / fix backport from upstream.
  • Fixed bug GH-12264: overflow/underflow on imagerotate degrees value
  • Fixed bug GH-16274: imagescale underflow on RBG channels / fix backport from upstream.

• LDAP

  • Fixed bug GH-16032: Various NULL pointer dereferencements in ldap_modify_batch().
  • Fixed bug GH-16101: Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list.
  • Fix GH-16132: php_ldap_do_modify() attempts to free pointer not allocated by ZMM.
  • Fix GH-16136: Memory leak in php_ldap_do_modify() when entry is not a proper dictionary.

• MBString

  • Fixed bug GH-16261: Reference invariant broken in mb_convert_variables().

• OpenSSL

  • Fixed stub for openssl_csr_new.

• PCRE

  • Fixed bug GH-16189: underflow on offset argument.
  • Fixed bug GH-16184: UBSan address overflowed in ext/pcre/php_pcre.c.

• PHPDBG

  • Fixed bug GH-15901: phpdbg: Assertion failure on i funcs.
  • Fixed bug GH-16181: phpdbg: exit in exception handler reports fatal error.

• Reflection

  • Fixed bug GH-16187: Assertion failure in ext/reflection/php_reflection.c.

• SAPI

  • Fixed bug GH-15395: php-fpm: zend_mm_heap corrupted with cgi-fcgi request.

• SimpleXML

  • Fixed bug GH-15837: Segmentation fault in ext/simplexml/simplexml.c.

• Sockets

  • Fixed bug GH-16267: socket_strerror overflow on errno argument.

• SOAP

  • Fixed bug #62900: Wrong namespace on xsd import error message.
  • Fixed bug GH-16237: Segmentation fault when cloning SoapServer.
  • Fix Soap leaking http_msg on error.
  • Fixed bug GH-16256: Assertion failure in ext/soap/php_encoding.c:460.
  • Fixed bug GH-16259: Soap segfault when classmap instantiation fails.

• Standard

  • Fixed bug GH-16053: Assertion failure in Zend/zend_hash.c.
  • Fixed bug GH-15613: overflow on unpack call hex string repeater.
  • Fixed bug GH-15937: overflow on stream timeout option value.

• Streams

  • Fixed bugs GH-15908 and GH-15026: leak / assertion failure in streams.c.
  • Fixed bug GH-15980: Signed integer overflow in main/streams/streams.c.

• TSRM

  • Prevent closing of unrelated handles.

• XML

  • Fixed bug GH-15868: Assertion failure in xml_parse_into_struct after exception.

New Features

Adds a Windows installer (MSI) for ZendPHP.

Supported versions include PHP 7.2, 7.3, 7.4, 8.0, 8.1, and 8.2.

Community fixes for PHP 8.2.7

• Core

  • Fixed bug GH-11152: Unable to alias namespaces containing reserved class names.
  • Fixed bug GH-9068: Conditional jump or move depends on uninitialised value(s).
  • Fixed bug GH-11189: Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state.
  • Fixed bug GH-11063: Compilation error on old GCC versions.
  • Fixed bug GH-11222: foreach by-ref may jump over keys during a rehash.

• Date

  • Fixed bug GH-11281: DateTimeZone::getName() does not include seconds in offset.

• Exif

  • Fixed bug GH-10834: exif_read_data() cannot read smaller stream wrapper chunk sizes.

• FPM

  • Fixed bug GH-10461: PHP-FPM segfault due to after free usage of child->ev_std(out|err).
  • Fixed bug #64539: FPM status page: query_string not properly JSON encoded.
  • Fixed memory leak for invalid primary script file handle.

• Hash

  • Fixed bug GH-11180: hash_file() appears to be restricted to 3 arguments.

• LibXML

  • Fixed bug GH-11160: Few tests failed building with new libxml 2.11.0.

• MBString

  • Fix bug GH-11217: Segfault in mb_strrpos / mb_strripos when using negative offset and ASCII encoding.

• Opcache

  • Fixed bug GH-11134: Incorrect match default branch optimization.
  • Fixed too wide OR and AND range inference.
  • Fixed missing class redeclaration error with OPcache enabled.
  • Fixed bug GH-11245: In some specific cases SWITCH with one default statement will cause segfault.

• PCNTL

  • Fixed maximum argument count of pcntl_forkx().

• PGSQL

  • Fixed parameter parsing of pg_lo_export().

• Phar

  • Fixed bug GH-11099: Generating phar.php during cross-compile can't be done.

• Soap

  • Fixed bug GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP.
  • Fixed bug GH-8426: make test fail while soap extension build.

• SPL

  • Fixed bug GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18).

• Standard

  • Fixed bug GH-11138: move_uploaded_file() emits open_basedir warning for source file.
  • Fixed bug GH-11274: POST/PATCH request switches to GET after a HTTP 308 redirect.

• Streams

  • Fixed bug GH-10031: STREAM_NOTIFY_PROGRESS over HTTP emitted irregularly for last chunk of data.
  • Fixed bug GH-11175: Stream Socket Timeout.
  • Fixed bug GH-11177: ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client.

Community Fixes for 8.1.20

• Core

  • Fixed bug GH-9068: Conditional jump or move depends on uninitialised value(s).
  • Fixed bug GH-11189: Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state.
  • Fixed bug GH-11222: foreach by-ref may jump over keys during a rehash.

• Date

  • Fixed bug GH-11281: DateTimeZone::getName() does not include seconds in offset.

• Exif

  • Fixed bug GH-10834: exif_read_data() cannot read smaller stream wrapper chunk sizes.

• FPM

  • Fixed bug GH-10461: PHP-FPM segfault due to after free usage of child->ev_std(out|err).
  • Fixed bug #64539: FPM status page: query_string not properly JSON encoded.
  • Fixed memory leak for invalid primary script file handle.

• Hash

  • Fixed bug GH-11180: hash_file() appears to be restricted to 3 arguments.

• LibXML

  • Fixed bug GH-11160: Few tests failed building with new libxml 2.11.0.

• Opcache

  • Fixed bug GH-11134: Incorrect match default branch optimization.
  • Fixed too wide OR and AND range inference.
  • Fixed bug GH-11245: In some specific cases SWITCH with one default statement will cause segfault.

• PGSQL

  • Fixed parameter parsing of pg_lo_export().

• Phar

  • Fixed bug GH-11099: Generating phar.php during cross-compile can't be done.

• Soap

  • Fixed bug GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP).
  • Fixed bug GH-8426: make test fail while soap extension build.

• SPL

  • Fixed bug GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)).

• Standard

  • Fixed bug GH-11138: move_uploaded_file() emits open_basedir warning for source file.
  • Fixed bug GH-11274: POST/PATCH request switches to GET after a HTTP 308 redirect.

• Streams

  • Fixed bug GH-10031: STREAM_NOTIFY_PROGRESS over HTTP emitted irregularly for last chunk of data.
  • Fixed bug GH-11175: Stream Socket Timeout.
  • Fixed bug GH-11177: ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client.

ZendPHP Changes

• Support ended for IBM i = V7R2
  • PHP is now built with OpenSSL v3. OpenSSL 3 is available from IBM i v7r3 OpenSource base rpm repositories.
  • NOTE FOR USERS ON IBM i : due to packaging issues by IBM, postgresql12-libpq package upgrade may not complete properly (missing symbolic links for libraries) and causes PHP postgreql extensions to not load. Fix: yum reinstall postgresql12-libpq

Community CVE Fixes

PHP version 8.3.12, 8.2.24, 8.1.30 CVE fixes

• CGI

  • Fixed bug GHSA-p99j-rfp4-xqvq: Bypass of CVE-2024-4577, Parameter Injection Vulnerability. (CVE-2024-8926)
  • Fixed bug GHSA-94p6-54jq-9mwp: cgi.force_redirect configuration is bypassable due to the environment variable collision. (CVE-2024-8927)

• FPM

  • Fixed bug GHSA-865w-9rf3-2wh5: Logs from childrens may be altered. (CVE-2024-9026)

• SAPI

  • Fixed bug GHSA-9pqp-7h25-4f32: Erroneous parsing of multipart form data. (CVE-2024-8925)

Backported PHP CVE Fixes

PHP version 7.2.34.20, 7.3.33.12, 7.4.33.7, 8.0.30.3 CVE fixes

• CGI

  • Fixed bug GHSA-p99j-rfp4-xqvq: Bypass of CVE-2024-4577, Parameter Injection Vulnerability. (CVE-2024-8926)
  • Fixed bug GHSA-94p6-54jq-9mwp: cgi.force_redirect configuration is bypassable due to the environment variable collision. (CVE-2024-8927)

• SAPI

  • Fixed bug GHSA-9pqp-7h25-4f32: Erroneous parsing of multipart form data. (CVE-2024-8925)

PHP version 7.4.33.7, 8.0.30.3 CVE fixes

• FPM
  • Fixed bug GHSA-865w-9rf3-2wh5: Logs from childrens may be altered. (CVE-2024-9026)

Community Fixes

PHP version 8.3.12 fixes

• Core

  • Fixed bug GH-15408: MSan false-positve on zend_max_execution_timer.
  • Fixed bug GH-15515: Configure error grep illegal option q.
  • Fixed bug GH-15514: Configure error: genif.sh: syntax error.
  • Fixed bug GH-15565: --disable-ipv6 during compilation produces error EAI_SYSTEM not found.
  • Fixed bug GH-15587: CRC32 API build error on arm 32-bit.
  • Fixed bug GH-15330: Do not scan generator frames more than once.
  • Fixed uninitialized lineno in constant AST of internal enums.

• Curl

  • FIxed bug GH-15547: curl_multi_select overflow on timeout argument.

• DOM

  • Fixed bug GH-15551: Segmentation fault (access null pointer) in ext/dom/xml_common.h.
  • Fixed bug GH-15654: Signed integer overflow in ext/dom/nodelist.c.

• Fileinfo

  • Fixed bug GH-15752: Incorrect error message for finfo_file with an empty filename argument.

• MySQLnd

  • Fixed bug GH-15432: Heap corruption when querying a vector.

• Opcache

  • Fixed bug GH-15661: Access null pointer in Zend/Optimizer/zend_inference.c.
  • Fixed bug GH-15658: Segmentation fault in Zend/zend_vm_execute.h.

• Standard

  • Fixed bug GH-15552: Signed integer overflow in ext/standard/scanf.c.

• Streams

  • Fixed bug GH-15628: php_stream_memory_get_buffer() not zero-terminated.

PHP version 8.2.24 fixes

• Core

  • Fixed bug GH-15408: MSan false-positve on zend_max_execution_timer.
  • Fixed bug GH-15515: Configure error grep illegal option q.
  • Fixed bug GH-15514: Configure error: genif.sh: syntax error.
  • Fixed bug GH-15565: --disable-ipv6 during compilation produces error EAI_SYSTEM not found.
  • Fixed bug GH-15587: CRC32 API build error on arm 32-bit.
  • Fixed bug GH-15330: Do not scan generator frames more than once.
  • Fixed uninitialized lineno in constant AST of internal enums.

• Curl

  • FIxed bug GH-15547: curl_multi_select overflow on timeout argument.

• DOM

  • Fixed bug GH-15551: Segmentation fault (access null pointer) in ext/dom/xml_common.h.

• Fileinfo

  • Fixed bug GH-15752: Incorrect error message for finfo_file with an empty filename argument.

• MySQLnd

  • Fixed bug GH-15432: Heap corruption when querying a vector.

• Opcache

  • Fixed bug GH-15661: Access null pointer in Zend/Optimizer/zend_inference.c.
  • Fixed bug GH-15658: Segmentation fault in Zend/zend_vm_execute.h.

• SOAP

  • Fixed bug #73182: PHP SOAPClient does not support stream context HTTP headers in array form.

• Standard

  • Fixed bug GH-15552: Signed integer overflow in ext/standard/scanf.c.

• Streams

  • Fixed bug GH-15628: php_stream_memory_get_buffer() not zero-terminated.

Community Fixes

PHP version 8.3.9 fixes

• Core
  • Fixed bug GH-14510: memleak due to missing pthread_attr_destroy()-call

PHP version 8.3.9, 8.2.21 fixes

• Core

  • Fixed bug GH-14315: Incompatible pointer type warnings
  • Fixed bug GH-12814: max_execution_time reached too early on MacOS 14 when running on Apple Silicon.
  • Fixed bug GH-14387: Crash when stack walking in destructor of yielded from values during Generator->throw().
  • Fixed bug GH-14456: Attempting to initialize class with private constructor calls destructor.
  • Fixed bug GH-14549: Incompatible function pointer type for fclose.

• BCMatch

  • Fixed bug: bcpowmod() with mod = -1 returns 1 when it must be 0.

• Curl

  • Fixed bug GH-14307: Test curl_basic_024 fails with curl 8.8.0.

• DOM

  • Fixed bug GH-14343: Memory leak in xml and dom.

• FPM

  • Fixed bug GH-14037: PHP-FPM ping.path and ping.response config vars are ignored in status pool.

• GD

  • Fix parameter numbers for imagecolorset().

• Intl

  • Fix reference handling in SpoofChecker.

• MySQLnd

  • Partially fix bug GH-10599: Apache crash on Windows when using a self-referencing anonymous function inside a class with an active mysqli connection.

• Opcache

  • Fixed bug GH-14267: opcache.jit=off does not allow enabling JIT at runtime.
  • Fixed TLS access in JIT on FreeBSD/amd64.
  • Fixed bug GH-11188: Error when building TSRM in ARM64.

• PDO ODBC

  • Fixed bug GH-14367: incompatible SDWORD type with iODBC.

• PHPDBG

  • Fixed bug GH-13681: segfault on watchpoint addition failure.

• Soap

  • Fixed bug #47925: PHPClient can't decompress response.
  • Fix missing error restore code.
  • Fix memory leak if calling SoapServer::setObject() twice.
  • Fix memory leak if calling SoapServer::setClass() twice.
  • Fix reading zlib ini settings in ext-soap.
  • Fix memory leaks with string function name lookups.
  • Fixed bug #69280: SoapClient classmap doesn't support fully qualified class name.
  • Fixed bug #76232: SoapClient Cookie Header Semicolon.
  • Fixed memory leaks when calling SoapFault::__construct() twice.

• Sodium

  • Fix memory leaks in ext/sodium on failure of some functions.

• SPL

  • Fixed bug GH-14290: Member access within null pointer in extension spl.

• Standard

  • Fixed bug GH-14483: Fixed off-by-one error in checking length of abstract namespace Unix sockets.

• Streams

  • Fixed bug GH-11078: PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors.

New Features

• Added LDAP authentication and authorization support to the ZendHQ daemon.

  ZendHQ daemon can now be configured to use a LDAP server, like ActiveDirectory or an OpenLDAP server, to authenticate and authorize ZendHQ users.

  LDAP authentication is performed asynchronously and JsonRpc clients cannot send other requests before authentication is finished and a response sent to the client.

• Added Z-Ray SQL queries support for the PHP sqlsrv extension.

  Support for the sqlsrv extension was already added in the previous 1.6.0 version, but now it is enabled for the public use.

Changes

• The ZendHQ PHP extension's zeromq PUB/SUB socket endpoint is now configurable

  The zendhq.daemon_pub_uri ZendHQ PHP extension's directive can now be used to set the daemon's zeromq PUB/SUB socket uri manually. The default is to leave this directive undefined and use the uri provided by the daemon.

• The Z-Ray token cookie max-age attribute is now configurable

  When Z-Ray is requested using the zraytok request parameter, then the ZendHQ PHP extension responds with the Set-Cookie: zraytok= max-age= response header. Consequent requests with the zraytok cookie will trigger additional Z-Ray requests without providing the zraytok request parameter.

  The value of the max-age attribute of the cookie is now configurable in the ini file and can be set to the number of seconds before the cookie expires.

  Setting this value to a value = 0 disables setting the zraytok cookie.

  Default value is 60 seconds.

• Optimized ZendHQ PHP extension tracing functionality

  Now the ZendHQ PHP extension becomes globally disabled if all the individual tracing functions (like Z-Ray, Monitoring and Code Tracing) are disabled.

  It is still possible to use the Job Queue PHP API.

• Optimized Code Tracing in the ZendHQ PHP extension.

  Code Tracing is now active only when requested manually or when at least one monitoring rule requires it. If Code Tracing is not requested or there are no monitoring rules with a Code Trace action, then Code Tracing stays inactive in order to improve PHP performance.

Bug Fixes

• Fixed a bug in the ZendHQ PHP extension that prevented Apache2 to reload.

  ZendHQ PHP extension has a limited number of global resources. The number of in-use resources was not reset when the PHP extension was re-initialized.

  In addition, a bug in zeromq caused worker processes to hang indefinitely in MSHUTDOWN.