Everything
php
Learn Community Releases The PHP Project
Home » Releases » 7.0 » 7.0.33 »

PHP 7.0.8

PHP 7.0 is no longer officially supported by the PHP project.

Official support refers to that provided direct by the PHP Project.

If you install PHP via third-party packages, support timelines may be different. Please read the Release Support Policy for more information.

The latest release of PHP 7.0 is 7.0.33 which includes important security patches.

Source Code

  • PHP 7.0.8 (tar.bz2)

    • sha256: 66dc7ba388490e07b1313fe3a06b1fa822e1310585fe29f4909995f131e27c8d

  • PHP 7.0.8 (tar.gz)

    • sha256: 1f024fa6d87594b99fa312e3185c357dcffa42e07d21c726f41d1fa6f773720b

  • PHP 7.0.8 (tar.xz)

    • sha256: 0a2142c458b0846f556b16da1c927d74c101aa951bb840549abe5c58584fb394

Change Log

  • core

    • Fixed bug #72218 (If host name cannot be resolved then PHP 7 crashes).
      Esminis at esminis dot lt
    • Fixed bug #72221 (segfault, past-the-end access).
      Lauri Kenttä
    • Fixed bug #72268 (Integer Overflow in nl2br()).
      Stas
    • Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).
      Stas
    • Fixed bug #72400 (Integer Overflow in addcslashes/addslashes).
      Stas
    • Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL).
      Stas

  • date

    • Fixed bug #63740 (strtotime seems to use both sunday and monday as start of week).
      Derick

  • fpm

    • Fixed bug #72308 (fastcgi_finish_request and logging environment variables).
      Laruence

  • gd

    • Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
      cmb
    • Fixed bug #72298 (pass2_no_dither out-of-bounds access).
      Stas
    • Fixed bug #72337 (invalid dimensions can lead to crash).
      Pierre
    • Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)
      Pierre
    • Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert).
      Stas
    • Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)
      Pierre

  • intl

    • Fixed bug #70484 (selectordinal doesn't work with named parameters).
      Anatol

  • mbstring

    • Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)
      Stas

  • mcrypt

    • Fixed bug #72455 (Heap Overflow due to integer overflows). (CVE-2016-5769)
      Stas

  • openssl

    • Fixed bug #72140 (segfault after calling ERR_free_strings()).
      Jakub Zelenka

  • pcre

    • Fixed bug #72143 (preg_replace uses int instead of size_t).
      Joe

  • pdo_pgsql

    • Fixed bug #71573 (Segfault (core dumped) if paramno beyond bound).
      Laruence
    • Fixed bug #72294 (Segmentation fault/invalid pointer in connection with pgsql_stmt_dtor).
      Anatol

  • phar

    • Fixed bug #72321 (invalid free in phar_extract_file()).
      hji at dyntopia dot com

  • phpdbg

    • Fixed bug #72284 (phpdbg fatal errors with coverage).
      Bob

  • postgres

    • Fixed bug #72195 (pg_pconnect/pg_connect cause use-after-free).
      Laruence
    • Fixed bug #72197 (pg_lo_create arbitrary read).
      Anatol

  • standard

    • Fixed bug #72369 (array_merge() produces references in PHP7).
      Dmitry
    • Fixed bug #72300 (ignore_user_abort(false) has no effect).
      Laruence
    • Fixed bug #72229 (Wrong reference when serialize/unserialize an object).
      Laruence
    • Fixed bug #72193 (dns_get_record returns array containing elements of type 'unknown').
      Laruence
    • Fixed bug #72017 (range() with float step produces unexpected result).
      Thomas Punt

  • wddx

    • Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)
      Stas

  • xml

    • Fixed bug #72206 (xml_parser_create/xml_parser_free leaks mem).
      Joe

  • xmlrpc

    • Fixed bug #72155 (use-after-free caused by get_zval_xmlrpc_type).
      Joe
      Laruence

  • zip

    • Fixed ug #72258 (ZipArchive converts filenames to unrecoverable form).
      Anatol
    • Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)
      Dmitry

PHP 7.0


  Represents a security release