MGASA-2024-0132

Core:

• Corrupted memory in destructor with weak references
• GC does not scale well with a lot of objects created in destructor DOM:
• Add some missing ZPP checks.
• Fix potential memory leak in XPath evaluation results. FPM:
• Fix incorrect check in fpm_shm_free(). Gettext:
• Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL. MySQLnd:
• Fixed handshake response [mysqlnd]
• Fix incorrect charset length in check_mb_eucjpms(). Opcache:
• JITed QM_ASSIGN may be optimized out when op1 is null
• Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded PDO:
• Fix various PDORow bugs. Random:
• Pre-PHP 8.2 compatibility for mt_srand with unknown modes
• Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used Session:
• Segfault with session_decode and compilation error Sockets:
• socket_getsockname returns random characters in the end of the socket name SPL:
• Unable to resize SplfixedArray after being unserialized in PHP 8.2.15
• Unexpected null pointer in zend_string.h Standard:
• Added validation of \n in $additional_headers of mail()
• Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
• password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)