PHP 8.4.11 → 8.4.16
5 releases · 0 breaking changes · 4 security fixes · 4 advisories fixed
4security0breaking0deprecated0feature0fix
Vulnerabilities fixed by this upgrade
- low GHSA-www2-q4fc-65wf Null byte termination in dns_get_record()
- 6.3 CVE-2025-14180 NULL Pointer Dereference in PDO quoting
- 6.5 CVE-2025-14178 Heap buffer overflow in array_merge()
- 6.3 CVE-2025-14177 Information Leak of Memory in getimagesize
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2025-14178: Heap buffer overflow in array_merge() in 8.4.16
- security Fixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting in 8.4.16
- security Fixes CVE-2025-14177: Information Leak of Memory in getimagesize in 8.4.16
- security Fixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record() in 8.4.16
Every release in between
securityFixes CVE-2025-14178: Heap buffer overflow in array_merge()
securityFixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting
securityFixes CVE-2025-14177: Information Leak of Memory in getimagesize
securityFixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record()