PHP 8.1.3, 8.0.28, and 7.4.28 released with security and bug fixes
PHP versions 8.1.3, 8.0.16, and 7.4.28 are now available to download/deploy. PHP 8.1.3 and 8.0.28 contain several bug fixes, and 8.1.3, 8.0.28, 7.4.28 all also contain a fix for a Use-After-Free security vulnerability discovered in PHP.
The Use-After-Free vulnerability, announced as CVE-2021-21708, could be exploited if a maliciously crafted string containing an integer value (commonly called a numeric string) was passed to PHP filter functions, resulting in a server crash.
Note that PHP 7.3 reached its End-Of-Life, and will not receive an update for this vulnerability, or any of the future potential security releases.
[PHP.Watch]() verified that the particular vulnerability is not exploitable on PHP 7.3 series.
Full Changelog of PHP 8.1.3
- Core:
- FFI:
- Fix:
FFI::cast()
from pointer to array is broken (#7867).
- Fix:
- Filter:
- Security Fix: UAF due to
php_filter_float()
failing for ints. (CVE-2021-21708) (#81708).
- Security Fix: UAF due to
- FPM:
- Fix: memory leak on invalid port.
- Fix: Invalid OpenMetrics response format returned by FPM status page (#7842).
- MBString:
- Fix:
mb_send_mail
may delimit headers withLF
only (#7902).
- Fix:
- MySQLnd:
- Fix: MariaDB version prefix
5.5.5-
is not stripped (#7972).
- Fix: MariaDB version prefix
pcntl
:- Fix:
pcntl_rfork
build for DragonFlyBSD.
- Fix:
- Sockets:
- Fix: sockets extension compilation errors (#7978).
- Standard:
Full Changelog of PHP 8.0.16
- Core:
- FFI:
- Fix:
FFI::cast()
from pointer to array is broken (#7867).
- Fix:
- Filter:
- Security Fix: UAF due to
php_filter_float()
failing for ints. (CVE-2021-21708) (#81708)
- Security Fix: UAF due to
- FPM:
- Fix: memory leak on invalid port.
- MBString:
- Fix:
mb_send_mail
may delimit headers withLF
only (#7902).
- Fix:
- MySQLnd:
- Fix: MariaDB version prefix
5.5.5-
is not stripped (#7972).
- Fix: MariaDB version prefix
- Sockets:
- Fix: sockets extension compilation errors (#7978).
- Fix:
ext/sockets
build on Haiku.
- Standard:
- Fix: mails are sent even if failure to log throws exception (#7875).
Full Changelog of PHP 7.4.28
- Filter:
- Security Fix: UAF due to
php_filter_float()
failing for ints. (CVE-2021-21708) (#81708).
- Security Fix: UAF due to