Everything
php
Learn Community Releases The PHP Project
Home » Releases » 7.0 » 7.0.33 »

PHP 7.0.9

PHP 7.0 is no longer officially supported by the PHP project.

Official support refers to that provided direct by the PHP Project.

If you install PHP via third-party packages, support timelines may be different. Please read the Release Support Policy for more information.

The latest release of PHP 7.0 is 7.0.33 which includes important security patches.

Source Code

  • PHP 7.0.9 (tar.bz2)

    • sha256: 2ee6968b5875f2f38700c58a189aad859a6a0b85fc337aa102ec2dc3652c3b7b

  • PHP 7.0.9 (tar.gz)

    • sha256: 93895a6a610c94751c890e5ee91a7f4bc0eae476b95fe30425d13f7ae88753d5

  • PHP 7.0.9 (tar.xz)

    • sha256: 970c322ba3e472cb0264b8ba9d4d92e87918da5d0cca53c4aba2a70545b8626d

Change Log

  • core

    • Fixed bug #72508 (strange references after recursive function call and "switch" statement).
      Laruence
    • Fixed bug #72513 (Stack-based buffer overflow vulnerability in virtual_file_ex).
      Stas
    • Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).
      Stas

  • bz2

    • Fixed bug #72613 (Inadequate error handling in bzread()).
      Stas

  • cli

    • Fixed bug #72484 (SCRIPT_FILENAME shows wrong path if the user specify router.php).
      Laruence

  • com

    • Fixed bug #72498 (variant_date_from_timestamp null dereference).
      Anatol

  • curl

    • Fixed bug #72541 (size_t overflow lead to heap corruption).
      Stas

  • date

    • Fixed bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing).
      derick

  • exif

    • Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
      Stas
    • Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
      Stas

  • gd

    • Fixed bug #43475 (Thick styled lines have scrambled patterns).
      cmb
    • Fixed bug #53640 (XBM images require width to be multiple of 8).
      cmb
    • Fixed bug #64641 (imagefilledpolygon doesn't draw horizontal line).
      cmb
    • Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
      Pierre
    • Fixed bug #72519 (imagegif/output out-of-bounds access).
      Pierre
    • Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).
      Pierre
    • Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine overflow).
      Pierre
    • Fixed bug #72494 (imagecropauto out-of-bounds access).
      Pierre

  • intl

    • Fixed bug #72533 (locale_accept_from_http out-of-bounds access).
      Stas

  • mbstring

    • Fixed bug #72405 (mb_ereg_replace - mbc_to_code (oniguruma) - oob read access).
      Laruence
    • Fixed bug #72399 (Use-After-Free in MBString (search_re)).
      Laruence

  • mcrypt

    • Fixed bug #72551, bug #72552 (In correct casting from size_t to int lead to heap overflow in mdecrypt_generic).
      Stas

  • pdo_pgsql

    • Fixed bug #72570 (Segmentation fault when binding parameters on a query without placeholders).
      Matteo

  • pcre

    • Fixed bug #72476 (Memleak in jit_stack).
      Laruence
    • Fixed bug #72463 (mail fails with invalid argument).
      Anatol

  • readline

    • Fixed bug #72538 (readline_redisplay crashes php).
      Laruence

  • standard

    • Fixed bug #72505 (readfile() mangles files larger than 2G).
      Cschneid
    • Fixed bug #72306 (Heap overflow through proc_open and $env parameter).
      Laruence

  • session

    • Fixed bug #72531 (ps_files_cleanup_dir Buffer overflow).
      Laruence
    • Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session Deserialization).
      Stas

  • snmp

    • Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).
      Stas

  • streams

    • Fixed bug #72439 (Stream socket with remote address leads to a segmentation fault).
      Laruence

  • xmlrpc

    • Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).
      Stas

  • zip

    • Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).
      Stas

PHP 7.0


  Represents a security release