Everything
php
Learn Community Releases The PHP Project
Home » Releases » 8.5 » 8.5.10 »

PHP 8.5.5

The latest release of PHP 8.5 is 8.5.10 which includes important security patches.

Source Code

  • PHP 8.5.5 (tar.gz)

    • sha256: 276279f637a875a514346b332bba6d8b06c036cf7979a858e5c55f72c4874884

  • PHP 8.5.5 (tar.bz2)

    • sha256: ee262beff61c431965d1f97192854b36208adeac38983c3498bb3500ae87283c

  • PHP 8.5.5 (tar.xz)

    • sha256: 95bec382f4bd00570a8ef52a58ec04d8d9b9a90494781f1c106d1b274a3902f2

Change Log

  • core

    • Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed trait properties).
      ilutov
    • Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies).
      iliaal

  • bz2

    • Fix truncation of total output size causing erroneous errors.
      ndossche

  • dom

    • Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes).
      ndossche

  • ffi

    • Fixed resource leak in FFI::cdef() onsymbol resolution failure.
      David Carlier

  • gd

    • Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support).
      David Carlier

  • opcache

    • Fixed bug GH-21052 (Preloaded constant erroneously propagated to file-cached script).
      ilutov
    • Fixed bug GH-20838 (JIT compiler produces wrong arithmetic results).
      Dmitry
      iliaal
    • Fixed bug GH-21267 (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context).
      Dmitry
      iliaal
    • Fixed bug GH-21395 (uaf in jit).
      ndossche

  • openssl

    • Fixed bug GH-21083 (Skip private_key_bits validation for EC/curve-based keys).
      iliaal
    • Fix missing error propagation for BIO_printf() calls.
      ndossche

  • pcntl

    • Fixed signal handler installation on AIX by bumping the storage size of the num_signals global.
      Calvin Buckley

  • pcre

    • Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl.
      David Carlier

  • phar

    • Fixed bug GH-21333 (use after free when unlinking entries during iteration of a compressed phar).
      David Carlier

  • snmp

    • Fixed bug GH-21336 (SNMP::setSecurity() undefined behavior with NULL arguments).
      David Carlier

  • soap

    • Fixed Set-Cookie parsing bug wrong offset while scanning attributes.
      David Carlier

  • spl

    • Fixed bug GH-21454 (missing write lock validation in SplHeap).
      ndossche

  • standard

    • Fixed bug GH-20906 (Assertion failure when messing up output buffers).
      ndossche
    • Fixed bug GH-20627 (Cannot identify some avif images with getimagesize).
      y-guyon
    • Fixed bug GH-22171 (Invalid auth header generation in http(s) stream wrapper).
      David Carlier

  • sysvshm

    • Fix memory leak in shm_get_var() when variable is corrupted.
      ndossche

  • xsl

    • Fix GH-21357 (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument).
      ndossche
    • Fixed bug GH-21496 (UAF in dom_objects_free_storage).
      David Carlier/ndossche

PHP 8.5


  Represents a security release