PHP 8.4.2 → 8.4.20
17 releases · 0 breaking changes · 14 security fixes · 14 advisories fixed
14security0breaking0deprecated0feature0fix
Vulnerabilities fixed by this upgrade
- low GHSA-www2-q4fc-65wf Null byte termination in dns_get_record()
- 6.3 CVE-2025-14180 NULL Pointer Dereference in PDO quoting
- 6.5 CVE-2025-14178 Heap buffer overflow in array_merge()
- 6.3 CVE-2025-14177 Information Leak of Memory in getimagesize
- medium CVE-2025-1735 pgsql extension does not check for errors during escaping
- 5.9 CVE-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
- low CVE-2025-1220 Null byte termination in hostnames
- medium CVE-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free
- low GHSA-wg4p-4hqh-c3g9 Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used
- medium CVE-2025-1219 libxml streams use wrong `content-type` header when requesting a redirected resource
- medium CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header
- medium CVE-2025-1861 Stream HTTP wrapper truncate redirect location to 1024 bytes
- medium CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon
- medium CVE-2025-1217 Header parser of `http` stream wrapper does not handle folded headers
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2025-14178: Heap buffer overflow in array_merge() in 8.4.16
- security Fixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting in 8.4.16
- security Fixes CVE-2025-14177: Information Leak of Memory in getimagesize in 8.4.16
- security Fixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record() in 8.4.16
- security Fixes CVE-2025-6491: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix in 8.4.10
- security Fixes CVE-2025-1735: pgsql extension does not check for errors during escaping in 8.4.10
- security Fixes CVE-2025-1220: Null byte termination in hostnames in 8.4.10
- security Fixes CVE-2024-11235: Reference counting in php_request_shutdown causes Use-After-Free in 8.4.5
- security Fixes GHSA-wg4p-4hqh-c3g9: Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used in 8.4.5
- security Fixes CVE-2025-1219: libxml streams use wrong `content-type` header when requesting a redirected resource in 8.4.5
- security Fixes CVE-2025-1736: Stream HTTP wrapper header check might omit basic auth header in 8.4.5
- security Fixes CVE-2025-1861: Stream HTTP wrapper truncate redirect location to 1024 bytes in 8.4.5
- security Fixes CVE-2025-1734: Streams HTTP wrapper does not fail for headers with invalid name and no colon in 8.4.5
- security Fixes CVE-2025-1217: Header parser of `http` stream wrapper does not handle folded headers in 8.4.5
Every release in between
securityFixes CVE-2025-14178: Heap buffer overflow in array_merge()
securityFixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting
securityFixes CVE-2025-14177: Information Leak of Memory in getimagesize
securityFixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record()
securityFixes CVE-2025-6491: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
securityFixes CVE-2025-1735: pgsql extension does not check for errors during escaping
securityFixes CVE-2025-1220: Null byte termination in hostnames
securityFixes CVE-2024-11235: Reference counting in php_request_shutdown causes Use-After-Free
securityFixes GHSA-wg4p-4hqh-c3g9: Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used
securityFixes CVE-2025-1219: libxml streams use wrong `content-type` header when requesting a redirected resource
securityFixes CVE-2025-1736: Stream HTTP wrapper header check might omit basic auth header
securityFixes CVE-2025-1861: Stream HTTP wrapper truncate redirect location to 1024 bytes
securityFixes CVE-2025-1734: Streams HTTP wrapper does not fail for headers with invalid name and no colon
securityFixes CVE-2025-1217: Header parser of `http` stream wrapper does not handle folded headers