
Backported from 8.2.32

- OpenSSL:
  . Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in
    openssl_encrypt with AES-WRAP-PAD). (David Carlier)

Backported from 8.2.31

- FPM:
  . Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735)
    (Jakub Zelenka)

- SOAP:
  . Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache
    Map). (CVE-2026-6722) (ilutov)
  . Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with
    SOAP_PERSISTENCE_SESSION). (CVE-2026-7261) (ilutov)
  . Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check).
    (CVE-2026-7262) (ilutov)

- Standard:
  . Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset).
    (CVE-2026-7568) (TimWolla)

Backported from 8.1.31

- CLI:
  . Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data
    Processing in CLI SAPI Interface). (nielsdos)

- LDAP:
  . Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
    (nielsdos)

- PDO DBLIB:
  . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing
    OOB writes). (CVE-2024-11236) (nielsdos)

- PDO Firebird:
  . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter
    causing OOB writes). (CVE-2024-11236) (nielsdos)

- Streams:
  . Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context
    might allow for CRLF injection in URIs). (CVE-2024-11234) (Jakub Zelenka)
  . Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with
    convert.quoted-printable-decode filter). (CVE-2024-11233) (nielsdos)

Backported from 8.1.30

- CGI:
  . Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection
    Vulnerability). (CVE-2024-8926) (nielsdos)
  . Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is
    bypassable due to the environment variable collision). (CVE-2024-8927)
    (nielsdos)

- SAPI:
  . Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).
    (CVE-2024-8925) (Arnaud)

Backported from 8.1.29

- CGI:
  . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection
    in PHP-CGI). (CVE-2024-4577) (nielsdos)

- Filter:
  . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL).
    (CVE-2024-5458) (nielsdos)

Backported from 8.1.28

- Standard:
  . Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to
    partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
  . Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true,
    opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)

Backported from 8.0.30

- Libxml:
  . Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading
    in XML without enabling it). (CVE-2023-3823) (nielsdos, ilutov)

- Phar:
  . Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()).
    (CVE-2023-3824) (nielsdos)

Backported from 8.0.29

- Soap:
  . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
    bytes in HTTP Digest authentication for SOAP).
    (CVE-2023-3247) (nielsdos, timwolla)

Backported from 8.0.28

- Core:
  . Fixed bug #81744 (Password_verify() always return true with some hash).
    (CVE-2023-0567). (Tim Düsterhus)
  . Fixed bug #81746 (1-byte array overrun in common path resolve code).
    (CVE-2023-0568). (Niels Dossche)
  . Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
    request body). (CVE-2023-0662) (Jakub Zelenka)

Backported from 8.0.27

- PDO/SQLite:
  . Fixed bug #81740 (PDO::quote() may return unquoted string).
    (CVE-2022-31631) (cmb)

Backported from 7.4.32

- Core:
  . Fixed bug #81727: Don't mangle HTTP variable names that clash with ones
    that have a specific semantic meaning. (CVE-2022-31629). (Derick)

- Phar:
  . Fixed bug #81726: phar wrapper: DOS when using quine gzip file.
    (CVE-2022-31628). (cmb)

Backported from 7.4.30

- mysqlnd:
  . Fixed bug #81719: mysqlnd/pdo password buffer overflow.
    (CVE-2022-31626) (c dot fol at ambionics dot io)

- pgsql
  . Fixed bug #81720: Uninitialized array in pg_query_params().
    (CVE-2022-31625) (cmb)

Backported from 7.3.33

- XML:
  . Fix #79971: special character is breaking the path in xml function.
    (CVE-2021-21707) (cmb)

Backported from 7.3.32

- FPM:
  . Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege
    escalation) (CVE-2021-21703). (Jakub Zelenka)

Backported from 7.3.31

- Zip:
  . Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination).
    (CVE-2021-21706) (cmb)

Backported from 7.3.30

- Phar:
  . Fixed bug #81211: Symlinks are followed when creating PHAR archive (cmb)

Backported from 7.3.29

- Core:
  . Fixed #81122: SSRF bypass in FILTER_VALIDATE_URL. (CVE-2021-21705) (cmb)

- PDO_Firebird:
  . Fixed #76448: Stack buffer overflow in firebird_info_cb. (CVE-2021-21704)
    (cmb)
  . Fixed #76449: SIGSEGV in firebird_handle_doer. (CVE-2021-21704) (cmb)
  . Fixed #76450: SIGSEGV in firebird_stmt_execute. (CVE-2021-21704) (cmb)
  . Fixed #76452: Crash while parsing blob data in firebird_fetch_blob.
    (CVE-2021-21704) (cmb)

Backported from 7.3.28

- Imap:
  . Fixed bug #80710 (imap_mail_compose() header injection). (cmb, Stas)

Backported from 7.3.27

- SOAP:
  . Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702) (cmb, Stas)

Backported from 7.3.26

- Standard:
  . Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo).
    (CVE-2020-7071) (cmb)

Backported from 7.2.34

- Core:
  . Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-`
    cookies can be sent). (CVE-2020-7070) (Stas)

Backported from 7.2.33

- Core:
  . Fixed bug #79877 (getimagesize function silently truncates after a null 
    byte) (cmb)

- Phar:
  . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile
    function). (CVE-2020-7068) (cmb)

Backported from 7.2.31

- Core:
  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
    (CVE-2019-11048) (cmb)
  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
    files are not cleaned). (CVE-2019-11048) (cmb)

Backported from 7.2.30

- Standard:
  . Fixed bug #79330 (shell_exec silently truncates after a null byte). (stas)
  . Fixed bug #79465 (OOB Read in urldecode). (CVE-2020-7067) (stas)

Backported from 7.2.29

- Core: 
  . Fixed bug #79329 (get_headers() silently truncates after a null byte) 
    (CVE-2020-7066) (cmb)

- EXIF:
  . Fixed bug #79282 (Use-of-uninitialized-value in exif) (CVE-2020-7064) 
    (Nikita)

Backported from 7.2.28

- DOM:
  . Fixed bug #77569: (Write Access Violation in DomImplementation). (Nikita,
    cmb)

- Phar:
  . Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have
    all-access permissions). (CVE-2020-7063) (stas)

- Session:
  . Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress).
    (CVE-2020-7062) (stas)

Backported from 7.2.27

- Mbstring:
  . Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`).
    (CVE-2020-7060) (Nikita)

- Standard:
  . Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059). (cmb)

Backported from 7.2.26

- Bcmath:
  . Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046).
    (cmb)

- Core:
  . Fixed bug #78862 (link() silently truncates after a null byte on Windows).
    (CVE-2019-11044). (cmb)
  . Fixed bug #78863 (DirectoryIterator class silently truncates after a null
    byte). (CVE-2019-11045). (cmb)

- EXIF:
  . Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer).
    (CVE-2019-11050). (Nikita)
  . Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047).
    (Nikita)

Backported from 7.1.33

- FPM:
  . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE).
    (CVE-2019-11043) (Jakub Zelenka)

Backported from 7.1.32

- mbstring:
  . Fixed CVE-2019-13224 (don't allow different encodings for onig_new_deluxe) (stas)

- pcre:
  . Fixed bug #75457 (heap use-after-free in pcrelib) (cmb)

Backported from 7.1.31

- EXIF:
  . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment).
    (CVE-2019-11042) (Stas)
  . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail).
    (CVE-2019-11041) (Stas)
  
- Phar:
  . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). (cmb)

- SQLite:
  . Upgraded to SQLite 3.28.0. (cmb)

Backported from 7.1.30

- EXIF:
  . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16).
    (CVE-2019-11040) (Stas)

- GD:
  . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm).
    (CVE-2019-11038) (cmb)

- Iconv:
  . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode()
    due to integer overflow). (CVE-2019-11039). (maris dot adam)

- SQLite:
  . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). (Stas)

Backported from 7.1.29

- EXIF
  . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). 
    (CVE-2019-11036) (Stas)

- Mail:
  . Fixed bug #77821 (Potential heap corruption in TSendMail()). (cmb)

Backported from 7.1.28

- EXIF:
  . Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). (CVE-2019-11034)
    (Stas)
  . Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value).
    (CVE-2019-11035) (Stas)

- SQLite3:
  . Added sqlite3.defensive INI directive. (BohwaZ)

Backported from 7.1.27

- Core:
  . Fixed bug #77630 (rename() across the device may allow unwanted access during
    processing). (Stas)

- EXIF:
  . Fixed bug #77509 (Uninitialized read in exif_process_IFD_in_TIFF). (Stas)
  . Fixed bug #77540 (Invalid Read on exif_process_SOFn). (Stas)
  . Fixed bug #77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas)
  . Fixed bug #77659 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas)

- PHAR:
  . Fixed bug #77396 (Null Pointer Dereference in phar_create_or_parse_filename).
    (bishop)
  . Fixed bug #77586 (phar_tar_writeheaders_int() buffer overflow). (bishop)

- SPL:
  . Fixed bug #77431 (openFile() silently truncates after a null byte). (cmb)

Backported from 7.1.26

- GD:
  . Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to
    use-after-free). (cmb)
  . Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap). (cmb)

- Mbstring:
  . Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token). (Stas)
  . Fixed bug #77371 (heap buffer overflow in mb regex functions
    - compile_string_node). (Stas)
  . Fixed bug #77381 (heap buffer overflow in multibyte match_at). (Stas)
  . Fixed bug #77382 (heap buffer overflow due to incorrect length in
    expand_case_fold_string). (Stas)
  . Fixed bug #77385 (buffer overflow in fetch_token). (Stas)
  . Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode). (Stas)
  . Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code). (Stas)

- Phar:
  . Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext). (Stas)

- Xmlrpc:
  . Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()). (cmb)
  . Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code). (Stas)

