|
7 | 7 |
|
8 | 8 | <h1>PHP 7 ChangeLog</h1> |
9 | 9 |
|
| 10 | +<section class="version" id="7.0.8"><!-- {{{ 7.0.8 --> |
| 11 | +<h3>Version 7.0.8</h3> |
| 12 | +<b><?php release_date('23-Jun-2016'); ?></b> |
| 13 | +<ul><li>Core: |
| 14 | +<ul> |
| 15 | + <li><?php bugfix(72218); ?> (If host name cannot be resolved then PHP 7 crashes).</li> |
| 16 | + <li><?php bugfix(72221); ?> (segfault, past-the-end access).</li> |
| 17 | + <li><?php bugfix(72268); ?> (Integer Overflow in nl2br()).</li> |
| 18 | + <li><?php bugfix(72275); ?> (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).</li> |
| 19 | + <li><?php bugfix(72400); ?> (Integer Overflow in addcslashes/addslashes).</li> |
| 20 | + <li><?php bugfix(72403); ?> (Integer Overflow in Length of String-typed ZVAL).</li> |
| 21 | +</ul></li> |
| 22 | +<li>Date: |
| 23 | +<ul> |
| 24 | + <li><?php bugfix(63740); ?> (strtotime seems to use both sunday and monday as start of week).</li> |
| 25 | +</ul></li> |
| 26 | +<li>FPM: |
| 27 | +<ul> |
| 28 | + <li><?php bugfix(72308); ?> (fastcgi_finish_request and logging environment variables).</li> |
| 29 | +</ul></li> |
| 30 | +<li>GD: |
| 31 | +<ul> |
| 32 | + <li><?php bugfix(66387); ?> (Stack overflow with imagefilltoborder). (CVE-2015-8874)</li> |
| 33 | + <li><?php bugfix(72298); ?> (pass2_no_dither out-of-bounds access).</li> |
| 34 | + <li><?php bugfix(72337); ?> (invalid dimensions can lead to crash).</li> |
| 35 | + <li><?php bugfix(72339); ?> (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)</li> |
| 36 | + <li><?php bugfix(72407); ?> (NULL Pointer Dereference at _gdScaleVert).</li> |
| 37 | + <li><?php bugfix(72446); ?> (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)</li> |
| 38 | +</ul></li> |
| 39 | +<li>Intl: |
| 40 | +<ul> |
| 41 | + <li><?php bugfix(70484); ?> (selectordinal doesn't work with named parameters).</li> |
| 42 | +</ul></li> |
| 43 | +<li>mbstring: |
| 44 | +<ul> |
| 45 | + <li><?php bugfix(72402); ?> (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)</li> |
| 46 | +</ul></li> |
| 47 | +<li>mcrypt: |
| 48 | +<ul> |
| 49 | + <li><?php bugfix(72455); ?> (Heap Overflow due to integer overflows). (CVE-2016-5769)</li> |
| 50 | +</ul></li> |
| 51 | +<li>OpenSSL: |
| 52 | +<ul> |
| 53 | + <li><?php bugfix(72140); ?> (segfault after calling ERR_free_strings()).</li> |
| 54 | +</ul></li> |
| 55 | +<li>PCRE: |
| 56 | +<ul> |
| 57 | + <li><?php bugfix(72143); ?> (preg_replace uses int instead of size_t).</li> |
| 58 | +</ul></li> |
| 59 | +<li>PDO_pgsql: |
| 60 | +<ul> |
| 61 | + <li><?php bugfix(71573); ?> (Segfault (core dumped) if paramno beyond bound).</li> |
| 62 | + <li><?php bugfix(72294); ?> (Segmentation fault/invalid pointer in connection with pgsql_stmt_dtor).</li> |
| 63 | +</ul></li> |
| 64 | +<li>Phar: |
| 65 | +<ul> |
| 66 | + <li><?php bugfix(72321); ?> (invalid free in phar_extract_file()).</li> |
| 67 | +</ul></li> |
| 68 | +<li>Phpdbg: |
| 69 | +<ul> |
| 70 | + <li><?php bugfix(72284); ?> (phpdbg fatal errors with coverage).</li> |
| 71 | +</ul></li> |
| 72 | +<li>Postgres: |
| 73 | +<ul> |
| 74 | + <li><?php bugfix(72195); ?> (pg_pconnect/pg_connect cause use-after-free).</li> |
| 75 | + <li><?php bugfix(72197); ?> (pg_lo_create arbitrary read).</li> |
| 76 | +</ul></li> |
| 77 | +<li>Standard: |
| 78 | +<ul> |
| 79 | + <li><?php bugfix(72017); ?> (range() with float step produces unexpected result).</li> |
| 80 | + <li><?php bugfix(72193); ?> (dns_get_record returns array containing elements of type 'unknown').</li> |
| 81 | + <li><?php bugfix(72229); ?> (Wrong reference when serialize/unserialize an object).</li> |
| 82 | + <li><?php bugfix(72300); ?> (ignore_user_abort(false) has no effect).</li> |
| 83 | +</ul></li> |
| 84 | +<li>WDDX: |
| 85 | +<ul> |
| 86 | + <li><?php bugfix(72340); ?> (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)</li> |
| 87 | +</ul></li> |
| 88 | +<li>XML: |
| 89 | +<ul> |
| 90 | + <li><?php bugfix(72206); ?> (xml_parser_create/xml_parser_free leaks mem).</li> |
| 91 | +</ul></li> |
| 92 | +<li>XMLRPC: |
| 93 | +<ul> |
| 94 | + <li><?php bugfix(72155); ?> (use-after-free caused by get_zval_xmlrpc_type).</li> |
| 95 | +</ul></li> |
| 96 | +<li>Zip: |
| 97 | +<ul> |
| 98 | + <li><?php bugfix(72258); ?> (ZipArchive converts filenames to unrecoverable form).</li> |
| 99 | + <li><?php bugfix(72434); ?> (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)</li> |
| 100 | +</ul></li> |
| 101 | +</ul> |
| 102 | +<!-- }}} --></section> |
| 103 | + |
10 | 104 | <section class="version" id="7.0.7"><!-- {{{ 7.0.7 --> |
11 | 105 | <h3>Version 7.0.7</h3> |
12 | 106 | <b><?php release_date('26-May-2016'); ?></b> |
|
36 | 130 | </ul></li> |
37 | 131 | <li>Intl: |
38 | 132 | <ul> |
| 133 | + <li><?php bugfix(64524); ?> (Add intl.use_exceptions to php.ini-*).</li> |
39 | 134 | <li><?php bugfix(72241); ?> (get_icu_value_internal out-of-bounds read). (CVE-2016-5093)</li> |
40 | 135 | </ul></li> |
41 | 136 | <li>JSON: |
|
70 | 165 | <ul> |
71 | 166 | <li><?php bugfix(72028); ?> (pg_query_params(): NULL converts to empty string).</li> |
72 | 167 | <li><?php bugfix(71062); ?> (pg_convert() doesn't accept ISO 8601 for datatype timestamp).</li> |
73 | | - <li><?php bugfix(72151); ?> (mysqli_fetch_object changed behaviour).</li> |
| 168 | + <li><?php bugfix(72151); ?> (mysqli_fetch_object changed behaviour). Patch to <?php bugl(71820) ?> is reverted.</li> |
74 | 169 | </ul></li> |
75 | 170 | <li>Reflection: |
76 | 171 | <ul> |
|
859 | 954 | <li>GD: |
860 | 955 | <ul> |
861 | 956 | <li><?php bugfix(53156); ?> (imagerectangle problem with point ordering).</li> |
862 | | - <li><?php bugfix(66387); ?> (Stack overflow with imagefilltoborder).</li> |
| 957 | + <li><?php bugfix(66387); ?> (Stack overflow with imagefilltoborder). (CVE-2015-8874)</li> |
863 | 958 | <li><?php bugfix(70102); ?> (imagecreatefromwebm() shifts colors).</li> |
864 | 959 | <li><?php bugfix(66590); ?> (imagewebp() doesn't pad to even length).</li> |
865 | 960 | <li><?php bugfix(66882); ?> (imagerotate by -90 degrees truncates image by 1px).</li> |
|
0 commit comments