PHP Release 7.3.13


    PHP 7.3.13 Release Announcement

    The PHP development team announces the immediate availability of PHP 7.3.13. This is a security release which also contains several bug fixes.

    All PHP 7.3 users are encouraged to upgrade to this version.

    For source downloads of PHP 7.3.13 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 7.3.13 (tar.bz2)
    SHA256: 5c7b89062814f3c3953d1518f63ed463fd452929e3a37110af4170c5d23267bc
    PHP 7.3.13 (tar.gz)
    SHA256: 9cf835416a3471d7e6615e9288e76813d55ffaf60e0aa9ce74884a7c228cb6dd
    PHP 7.3.13 (tar.xz)
    SHA256: 57ac55fe442d2da650abeb9e6fa161bd3a98ba6528c029f076f8bba43dd5c228
    Change Logs
    bcmath
    • Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046).
    core
    • Fixed bug #78862 (link() silently truncates after a null byte on Windows). (CVE-2019-11044).
    • Fixed bug #78863 (DirectoryIterator class silently truncates after a null byte). (CVE-2019-11045).
    • Fixed bug #78943 (mail() may release string with refcount==1 twice). (CVE-2019-11049).
    • Fixed bug #78787 (Segfault with trait overriding inherited private shadow property).
    • Fixed bug #78868 (Calling __autoload() with incorrect EG(fake_scope) value).
    • Fixed bug #78296 (is_file fails to detect file).
    exif
    • Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050).
    • Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047).
    gd
    • Fixed bug #78849 (GD build broken with -D SIGNED_COMPARE_SLOW).
    mbstring
    • Upgraded bundled Oniguruma to 6.9.4.
    opcache
    • Fixed potential ASLR related invalid opline handler issues.
    • Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
    pcre
    • Fixed bug #78853 (preg_match() may return integer > 1).
    standard
    • Fixed bug #78759 (array_search in $GLOBALS).
    • Fixed bug #77638 (var_export'ing certain class instances segfaults).
    • Fixed bug #78840 (imploding $GLOBALS crashes).
    • Fixed bug #78833 (Integer overflow in pack causes out-of-bound access).
    • Fixed bug #78814 (strip_tags allows / in tag name => whitelist bypass).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top