Everything
php
Learn Community Releases The PHP Project
Home » Releases » 8.5 » 8.5.10 »

PHP 8.5.2

The latest release of PHP 8.5 is 8.5.10 which includes important security patches.

Source Code

  • PHP 8.5.2 (tar.gz)

    • sha256: 379ccccefcc85f28286444cf01bc0db017c79d513417267f5bb1d804b8428c22

  • PHP 8.5.2 (tar.bz2)

    • sha256: f7efdeccc3a810b18920692306536b99a3ba86610dbd0795a296cf77d3fb3a06

  • PHP 8.5.2 (tar.xz)

    • sha256: cb75a9b00a2806f7390dd64858ef42a47b443b3475769c8af6af33a18b1381f1

Change Log

  • core

    • Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature with dynamic class const lookup default argument).
      ilutov
    • Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()).
      ndossche
    • Fixed bug GH-20714 (Uncatchable exception thrown in generator).
      ilutov
    • Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation).
      ndossche
    • Fixed bug GH-20745 ("Casting out of range floats to int" applies to strings).
      Bob

  • dom

    • Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning via clone on malformed objects).
      ndossche
    • Fixed bug GH-20444 (Dom\XMLDocument::C14N() seems broken compared to DOMDocument::C14N()).
      ndossche

  • exif

    • Fixed bug GH-20631 (Integer underflow in exif HEIF parsing when pos.size < 2).
      Oblivionsage

  • intl

    • Fixed IntlListFormatter::getErrorCode() and getErrorMessage() not reflecting format() failures.
      Weilin Du
    • Fix leak in umsg_format_helper().
      ndossche

  • ldap

    • Fix memory leak in ldap_set_options().
      ndossche

  • lexbor

    • Fixed bug GH-20668 (\Uri\WhatWg\Url::withHost() crashes (SEGV) for URLs using the file: scheme).
      lexborisov

  • mbstring

    • Fixed bug GH-20674 (mb_decode_mimeheader does not handle separator).
      Yuya Hamada

  • openssl

    • Fixed bug GH-20802 (undefined behavior with invalid SNI_server_certs options).
      David Carlier

  • pcntl

    • Fixed bug with pcntl_getcpuaffinity() on solaris regarding invalid process ids handling.
      David Carlier

  • phar

    • Fixed bug GH-20732 (Phar::LoadPhar undefined behavior when reading fails).
      ndossche
    • Fix SplFileInfo::openFile() in write mode.
      ndossche
    • Fix build on legacy OpenSSL 1.1.0 systems.
      Giovanni Giacobbi
    • Fixed bug #74154 (Phar extractTo creates empty files).
      ndossche

  • session

    • Fix support for MM module.
      Michael Orlitzky

  • sqlite3

    • Fixed bug GH-20699 (SQLite3Result fetchArray return array|false, null returned).
      ndossche
      plusminmax

  • standard

    • Fix error check for proc_open() command.
      ndossche
    • Fix memory leak in mail() when header key is numeric.
      Girgias
    • Fixed bug GH-20582 (Heap Buffer Overflow in iptcembed).
      ndossche

  • uri

    • Fixed bug GH-20771 (Assertion failure when getUnicodeHost() returns empty string).
      ndossche

  • zlib

    • Fix OOB gzseek() causing assertion failure.
      ndossche

PHP 8.5


  Represents a security release