Everything
php
Learn Community Releases The PHP Project
Home » Releases » 7.0 » 7.0.33 »

PHP 7.0.10

PHP 7.0 is no longer officially supported by the PHP project.

Official support refers to that provided direct by the PHP Project.

If you install PHP via third-party packages, support timelines may be different. Please read the Release Support Policy for more information.

The latest release of PHP 7.0 is 7.0.33 which includes important security patches.

Source Code

Change Log

  • core

    • Fixed bug #72629 (Caught exception assignment to variables ignores references).
      Laruence
    • Fixed bug #72594 (Calling an earlier instance of an included anonymous class fatals).
      Laruence
    • Fixed bug #72581 (previous property undefined in Exception after deserialization).
      Laruence
    • Fixed bug #72496 (Cannot declare public method with signature incompatible with parent private method).
      Pedro Magalhães
    • Fixed bug #72024 (microtime() leaks memory).
      maroszek at gmx dot net
    • Fixed bug #71911 (Unable to set --enable-debug on building extensions by phpize on Windows).
      Yuji Uchiyama
    • Fixed bug causing ClosedGeneratorException being thrown into the calling code instead of the Generator yielding from.
      Bob
    • Implemented FR #72614 (Support "nmake test" on building extensions by phpize).
      Yuji Uchiyama
    • Fixed bug #72641 (phpize (on Windows) ignores PHP_PREFIX).
      Yuji Uchiyama
    • Fixed potential segfault in object storage freeing in shutdown sequence.
      Bob
    • Fixed bug #72663 (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization).
      Stas
    • Fixed bug #72681 (PHP Session Data Injection Vulnerability).
      Stas
    • Fixed bug #72683 (getmxrr broken).
      Anatol
    • Fixed bug #72742 (memory allocator fails to realloc small block to large one).
      Stas
    • Fixed URL rewriter partially. It would not rewrite '//example.com/' URL unconditionally. Only requested host(HTTP_HOST) is rewritten.
      Yasuo

  • bz2

    • Fixed bug #72837 (integer overflow in bzdecompress caused heap corruption).
      Stas

  • calendar

    • Fixed bug #67976 (cal_days_month() fails for final month of the French calendar).
      cmb
    • Fixed bug #71894 (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd).
      cmb

  • com

    • Fixed bug #72569 (DOTNET/COM array parameters broke in PHP7).
      Anatol

  • curl

    • Fixed bug #71709 (curl_setopt segfault with empty CURLOPT_HTTPHEADER).
      Pierrick
    • Fixed bug #71929 (CURLINFO_CERTINFO data parsing error).
      Pierrick
    • Fixed bug #72674 (Heap overflow in curl_escape).
      Stas

  • dom

    • Fixed bug #66502 (DOM document dangling reference).
      Sean Heelan
      cmb

  • exif

    • Fixed bug #72735 (Samsung picture thumb not read (zero size)).
      Kalle
      Remi
    • Fixed bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF).
      Stas

  • filter

    • Fixed bug #71745 (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 range).
      bugs dot php dot net at majkl578 dot cz

  • fpm

    • Fixed bug #72575 (using --allow-to-run-as-root should ignore missing user).
      gooh

  • gd

    • Fixed bug #72596 (imagetypes function won't advertise WEBP support).
      cmb
    • Fixed bug #72604 (imagearc() ignores thickness for full arcs).
      cmb
    • Fixed bug #70315 (500 Server Error but page is fully rendered).
      cmb
    • Fixed bug #43828 (broken transparency of imagearc for truecolor in blendingmode).
      cmb
    • Fixed bug #66555 (Always false condition in ext/gd/libgd/gdkanji.c).
      cmb
    • Fixed bug #68712 (suspicious if-else statements).
      cmb
    • Fixed bug #72697 (select_colors write out-of-bounds).
      Stas
    • Fixed bug #72730 (imagegammacorrect allows arbitrary write access).
      Stas

  • intl

    • Fixed bug #72639 (Segfault when instantiating class that extends IntlCalendar and adds a property).
      Laruence
    • Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain names).
      cmb

  • mbstring

    • Fixed bug #72691 (mb_ereg_search raises a warning if a match zero-width).
      cmb
    • Fixed bug #72693 (mb_ereg_search increments search position when a match zero-width).
      cmb
    • Fixed bug #72694 (mb_ereg_search_setpos does not accept a string's last position).
      cmb
    • Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error).
      ju1ius

  • mcrypt

    • Fixed bug #72782 (Heap Overflow due to integer overflows).
      Stas

  • opcache

    • Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
      Keyur

  • pcre

    • Fixed bug #72688 (preg_match missing group names in matches).
      cmb

  • pdo_pgsql

    • Fixed bug #70313 (PDO statement fails to throw exception).
      Matteo

  • reflection

    • Fixed bug #72222 (ReflectionClass::export doesn't handle array constants).
      Nikita Nefedov

  • simplexml

    • Fixed bug #72588 (Using global var doesn't work while accessing SimpleXML element).
      Laruence

  • snmp

    • Fixed bug #72708 (php_snmp_parse_oid integer overflow in memory allocation).
      djodjo at gmail dot com

  • spl

    • Fixed bug #55701 (GlobIterator throws LogicException).
      Valentin VĂLCIU
    • Fixed bug #72646 (SplFileObject::getCsvControl does not return the escape character).
      cmb
    • Fixed bug #72684 (AppendIterator segfault with closed generator).
      Pierrick

  • sqlite3

    • Fixed bug #72668 (Spurious warning when exception is thrown in user defined function).
      Laruence
    • Fixed bug #72571 (SQLite3::bindValue, SQLite3::bindParam crash).
      Laruence
    • Implemented FR #72653 (SQLite should allow opening with empty filename).
      cmb
    • Updated to SQLite3 3.13.0.
      cmb

  • standard

    • Fixed bug #72622 (array_walk + array_replace_recursive create references from nothing).
      Laruence
    • Fixed bug #72152 (base64_decode $strict fails to detect null byte).
      Lauri Kenttä
    • Fixed bug #72263 (base64_decode skips a character after padding in strict mode).
      Lauri Kenttä
    • Fixed bug #72264 (base64_decode $strict fails with whitespace between padding).
      Lauri Kenttä
    • Fixed bug #72330 (CSV fields incorrectly split if escape char followed by UTF chars).
      cmb

  • streams

    • Fixed bug #41021 (Problems with the ftps wrapper).
      vhuk
    • Fixed bug #54431 (opendir() does not work with ftps:// wrapper).
      vhuk
    • Fixed bug #72667 (opendir() with ftp:// attempts to open data stream for non-existent directories).
      vhuk
    • Fixed bug #72771 (ftps:// wrapper is vulnerable to protocol downgrade attack).
      Stas

  • xmlrpc

    • Fixed bug #72647 (xmlrpc_encode() unexpected output after referencing array elements).
      Laruence

  • wddx

    • Fixed bug #72564 (boolean always deserialized as "true") (Remi)
    • Fixed bug #72142 (WDDX Packet Injection Vulnerability in wddx_serialize_value()).
      Taoguang Chen
    • Fixed bug #72749 (wddx_deserialize allows illegal memory access) (Stas)
    • Fixed bug #72750 (wddx_deserialize null dereference).
      Stas
    • Fixed bug #72790 (wddx_deserialize null dereference with invalid xml).
      Stas
    • Fixed bug #72799 (wddx_deserialize null dereference in php_wddx_pop_element).
      Stas

  • zip

    • Fixed bug #72660 (NULL Pointer dereference in zend_virtual_cwd).
      Laruence

PHP 7.0


  Represents a security release