PHP 8.1.3, 8.0.28, and 7.4.28 released with security and bug fixes

PHP versions 8.1.3, 8.0.16, and 7.4.28 are now available to download/deploy. PHP 8.1.3 and 8.0.28 contain several bug fixes, and 8.1.3, 8.0.28, 7.4.28 all also contain a fix for a Use-After-Free security vulnerability discovered in PHP.

The Use-After-Free vulnerability, announced as CVE-2021-21708, could be exploited if a maliciously crafted string containing an integer value (commonly called a numeric string) was passed to PHP filter functions, resulting in a server crash.

Note that PHP 7.3 reached its End-Of-Life, and will not receive an update for this vulnerability, or any of the future potential security releases.

PHP.Watch verified that the particular vulnerability is not exploitable on PHP 7.3 series.

---

Full Changelog of PHP 8.1.3

• Core:
  • Fix: Attribute instantiation leaves dangling pointer (#81430).
  • Fix: Environment vars may be mangled on Windows (#7896).
  • Fix: Segfault when INI file is not readable (#7883).
• FFI:
  • Fix: FFI::cast() from pointer to array is broken (#7867).
• Filter:
  • Security Fix: UAF due to php_filter_float() failing for ints. (CVE-2021-21708) (#81708).
• FPM:
  • Fix: memory leak on invalid port.
  • Fix: Invalid OpenMetrics response format returned by FPM status page (#7842).
• MBString:
  • Fix: mb_send_mail may delimit headers with LF only (#7902).
• MySQLnd:
  • Fix: MariaDB version prefix 5.5.5- is not stripped (#7972).
• pcntl:
  • Fix: pcntl_rfork build for DragonFlyBSD.
• Sockets:
  • Fix: sockets extension compilation errors (#7978).
• Standard:
  • Fix: Regression in unpack for negative int value (#7899).
  • Fix: mails are sent even if failure to log throws exception (#7875).

Full Changelog of PHP 8.0.16

• Core:
  • Fix: Attribute instantiation leaves dangling pointer (#81430).
  • Fix: Environment vars may be mangled on Windows (#7896).
• FFI:
  • Fix: FFI::cast() from pointer to array is broken (#7867).
• Filter:
  • Security Fix: UAF due to php_filter_float() failing for ints. (CVE-2021-21708) (#81708)
• FPM:
  • Fix: memory leak on invalid port.
• MBString:
  • Fix: mb_send_mail may delimit headers with LF only (#7902).
• MySQLnd:
  • Fix: MariaDB version prefix 5.5.5- is not stripped (#7972).
• Sockets:
  • Fix: sockets extension compilation errors (#7978).
  • Fix: ext/sockets build on Haiku.
• Standard:
  • Fix: mails are sent even if failure to log throws exception (#7875).

Full Changelog of PHP 7.4.28

• Filter:
  • Security Fix: UAF due to php_filter_float() failing for ints. (CVE-2021-21708) (#81708).