8.1 has reached end-of-life and will no longer receive
bugfixes or security patches from the PHP Project. Some downstream distributions may still continue to provide
backported fixes for a time, depending on their support policy.
Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
pdo dblib
Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
pdo firebird
Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
streams
Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
PHP 8.1.30
Released 26 Sep, 2024
cgi
Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
fpm
Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
sapi
Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
PHP 8.1.29
Released 06 Jun, 2024
cgi
Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
filter
Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
openssl
The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.
Fixed bug GH-11625 (DOMElement::replaceWith() doesn't replace node with DOMDocumentFragment but just deletes node or causes wrapping <></> depending on libxml2 version).
fileinfo
Fixed bug GH-11298 (finfo returns wrong mime type for xz files).
ftp
Fix context option check for "overwrite".
Fixed bug GH-10562 (Memory leak and invalid state with consecutive ftp_nb_fget).
gd
Fix most of the external libgd test failures.
hash
Fix use-of-uninitialized-value in hash_pbkdf2(), fix missing $options parameter in signature.
intl
Fix memory leak in MessageFormatter::format() on failure.
libxml
Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
Fixed bug GH-9891 (DateTime modify with unixtimestamp (@) must work like setTimestamp).
Fixed bug GH-10218 (DateTimeZone fails to parse time zones that contain the "+" character).
fiber
Fix assertion on stack allocation size.
fpm
Fixed bug GH-9981 (FPM does not reset fastcgi.error_header).
Fixed bug #67244 (Wrong owner:group for listening unix socket).
hash
Handle exceptions from __toString in XXH3's initialization
ldap
Fixed bug GH-10112 (LDAP\Connection::__construct() refers to ldap_create()).
mbstring
Fixed: mb_strlen (and a couple of other mbstring functions) would wrongly treat 0x80, 0xFD, 0xFE, 0xFF, and certain other byte values as the first byte of a 2-byte SJIS character.
opcache
Fix inverted bailout value in zend_runtime_jit() .
Fix access to uninitialized variable in accel_preload().
Fix zend_jit_find_trace() crashes.
Added missing lock for EXIT_INVALIDATE in zend_jit_trace_exit.
phar
Fix wrong flags check for compression method in phar_object.c
phpdbg
Fix undefined behaviour in phpdbg_load_module_or_extension().
Fix NULL pointer dereference in phpdbg_create_conditional_breal().
