FFI is one of the features that made Python and LuaJIT very useful for fast
prototyping. It allows calling C functions and using C data types from pure
scripting language and therefore develop “system code” more productively.
For PHP, FFI opens a way to write PHP extensions and bindings to C libraries
in pure PHP.
Provides
Requires
License
PHP
Changelog
* Mon May 11 2026 Remi Collet <remi@remirepo.net> - 8.0.30-16
- Fix XSS within status endpoint
CVE-2026-6735
- Fix Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
CVE-2026-7259
- Fix SQL injection via NUL bytes in quoted strings
CVE-2025-14179
- Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
CVE-2026-6722
- Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
CVE-2026-7261
- Fix Broken Apache map value NULL check
CVE-2026-7262
- Fix Signed integer overflow of char array offset
CVE-2026-7568
- Fix Consistently pass unsigned char to ctype.h functions
CVE-2026-7258
* Thu Dec 18 2025 Remi Collet <remi@remirepo.net> - 8.0.30-15
- Fix Null byte termination in dns_get_record()
GHSA-www2-q4fc-65wf
- Fix Heap buffer overflow in array_merge()
CVE-2025-14178
- Fix Information Leak of Memory in getimagesize
CVE-2025-14177
* Thu Jul 03 2025 Remi Collet <remi@remirepo.net> - 8.0.30-14
- Fix pgsql extension does not check for errors during escaping
CVE-2025-1735
- Fix NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
CVE-2025-6491
- Fix Null byte termination in hostnames
CVE-2025-1220
* Thu Mar 13 2025 Remi Collet <remi@remirepo.net> - 8.0.30-13
- Fix libxml streams use wrong `content-type` header when requesting a redirected resource
CVE-2025-1219
- Fix Stream HTTP wrapper header check might omit basic auth header
CVE-2025-1736
- Fix Stream HTTP wrapper truncate redirect location to 1024 bytes
CVE-2025-1861
- Fix Streams HTTP wrapper does not fail for headers without colon
CVE-2025-1734
- Fix Header parser of `http` stream wrapper does not handle folded headers
CVE-2025-1217
- use oracle client library version 23.7 on x86_64 and aarch64
* Thu Feb 13 2025 Remi Collet <remi@remirepo.net> - 8.0.30-12
- backport fix for ICU 74+
- backport fix strict prototypes
* Wed Nov 27 2024 Remi Collet <remi@remirepo.net> - 8.0.30-11
- Fix Leak partial content of the heap through heap buffer over-read
CVE-2024-8929
* Fri Nov 22 2024 Remi Collet <remi@remirepo.net> - 8.0.30-10
- Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
GHSA-4w77-75f9-2c8w
- Fix OOB access in ldap_escape
CVE-2024-8932
- Fix Integer overflow in the dblib/firebird quoter causing OOB writes
CVE-2024-11236
- Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs
CVE-2024-11234
- Fix Single byte overread with convert.quoted-printable-decode filter
CVE-2024-11233
* Thu Sep 26 2024 Remi Collet <remi@remirepo.net> - 8.0.30-9
- Fix Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
CVE-2024-4577
- Fix Bypass of CVE-2024-4577, Parameter Injection Vulnerability
CVE-2024-8926
- Fix cgi.force_redirect configuration is bypassable due to the environment variable collision
CVE-2024-8927
- Fix Logs from childrens may be altered
CVE-2024-9026
- Fix Erroneous parsing of multipart form data
CVE-2024-8925
- use ICU 74.2
* Mon Aug 26 2024 Remi Collet <remi@remirepo.net> - 8.0.30-8
- add backport for https://bugs.php.net/79589
error:14095126:SSL routines:ssl3_read_n:unexpected eof while reading
* Wed Jul 31 2024 Remi Collet <remi@remirepo.net> - 8.0.30-7
- use oracle client library version 23.5 on x86_64
* Tue Jun 04 2024 Remi Collet <remi@remirepo.net> - 8.0.30-6
- Fix filter bypass in filter_var FILTER_VALIDATE_URL
CVE-2024-5458
* Wed Apr 10 2024 Remi Collet <remi@remirepo.net> - 8.0.30-5
- Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
CVE-2024-2756
- Fix password_verify can erroneously return true opening ATO risk
CVE-2024-3096
* Wed Mar 06 2024 Remi Collet <remi@remirepo.net> - 8.0.30-4
- use oracle client library version 21.13 on x86_64
- patch test suite for zlib-ng
- add EOL message
* Tue Dec 12 2023 Remi Collet <remi@remirepo.net> - 8.0.30-3
- use ICU 73.2
- use oracle client library version 21.12 on x86_64, 19.19 on aarch64
- add fixes for libxml 2.11 and 2.12 from 8.1
* Thu Sep 21 2023 Remi Collet <remi@remirepo.net> - 8.0.30-2
- use oracle client library version 21.11 on x86_64, 19.19 on aarch64
- use official Oracle Instant Client RPM
* Thu Aug 03 2023 Remi Collet <remi@remirepo.net> - 8.0.30-1
- Update to 8.0.30 - http://www.php.net/releases/8_0_30.php
- move httpd/nginx wants directive to config files in /etc
* Thu Jun 08 2023 Remi Collet <remi@remirepo.net> - 8.0.29-1
- Update to 8.0.29 - http://www.php.net/releases/8_0_29.php
* Thu May 11 2023 Remi Collet <remi@remirepo.net> - 8.0.28-4
- define %__phpize and %__phpconfig
* Fri Apr 21 2023 Remi Collet <remi@remirepo.net> - 8.0.28-3
- use ICU 72.1
- use oracle client library version 21.10
- fix missing TZData version in intl phpinfo
- fix possible buffer overflow in date
* Tue Feb 21 2023 Remi Collet <remi@remirepo.net> - 8.0.28-2
- F38: enable imap extension
* Tue Feb 14 2023 Remi Collet <remi@remirepo.net> - 8.0.28-1
- Update to 8.0.28 - http://www.php.net/releases/8_0_28.php
- add dependency on pcre2 minimal version
* Fri Feb 10 2023 Remi Collet <remi@remirepo.net> - 8.0.27-2
- F38: disable imap extension
* Tue Jan 03 2023 Remi Collet <remi@remirepo.net> - 8.0.27-1
- Update to 8.0.27 - http://www.php.net/releases/8_0_27.php
- use oracle client library version 21.8
* Wed Nov 23 2022 Remi Collet <remi@remirepo.net> - 8.0.26-1
- Update to 8.0.26 - http://www.php.net/releases/8_0_26.php
* Wed Nov 09 2022 Remi Collet <remi@remirepo.net> - 8.0.26~RC1-1
- update to 8.0.26RC1
* Tue Oct 25 2022 Remi Collet <remi@remirepo.net> - 8.0.25-1
- Update to 8.0.25 - http://www.php.net/releases/8_0_25.php
* Tue Oct 11 2022 Remi Collet <remi@remirepo.net> - 8.0.25~RC1-1
- update to 8.0.25RC1
* Wed Sep 28 2022 Remi Collet <remi@remirepo.net> - 8.0.24-1
- Update to 8.0.24 - http://www.php.net/releases/8_0_24.php
* Wed Sep 14 2022 Remi Collet <remi@remirepo.net> - 8.0.24~RC1-1
- update to 8.0.24RC1
* Tue Aug 30 2022 Remi Collet <remi@remirepo.net> - 8.0.23-1
- Update to 8.0.23 - http://www.php.net/releases/8_0_23.php
* Wed Aug 17 2022 Remi Collet <remi@remirepo.net> - 8.0.23~RC1-1
- update to 8.0.23RC1
- use oracle client library version 21.7
- use ICU 71.1
* Tue Aug 02 2022 Remi Collet <remi@remirepo.net> - 8.0.22-1
- Update to 8.0.22 - http://www.php.net/releases/8_0_22.php
* Fri Jul 29 2022 Remi Collet <remi@remirepo.net> - 8.0.22~RC1-2
- fix snmp backport
* Tue Jul 19 2022 Remi Collet <remi@remirepo.net> - 8.0.22~RC1-1
- update to 8.0.22RC1
* Wed Jul 06 2022 Remi Collet <remi@remirepo.net> - 8.0.21-2
- Update to 8.0.21 - http://www.php.net/releases/8_0_21.php
- rebuild with new sources
* Tue Jul 05 2022 Remi Collet <remi@remirepo.net> - 8.0.21-1
- Update to 8.0.21 - http://www.php.net/releases/8_0_21.php
* Tue Jun 21 2022 Remi Collet <remi@remirepo.net> - 8.0.21~RC1-1
- update to 8.0.21RC1
* Wed Jun 08 2022 Remi Collet <remi@remirepo.net> - 8.0.20-1
- Update to 8.0.20 - http://www.php.net/releases/8_0_20.php
* Fri Jun 03 2022 Remi Collet <remi@remirepo.net> - 8.0.20~RC1-2
- add upstream patch to initialize pcre before mbstring
* Wed May 25 2022 Remi Collet <remi@remirepo.net> - 8.0.20~RC1-1
- update to 8.0.20RC1
* Tue May 10 2022 Remi Collet <remi@remirepo.net> - 8.0.19-1
- Update to 8.0.19 - http://www.php.net/releases/8_0_19.php
- use oracle client library version 21.6
* Tue Apr 26 2022 Remi Collet <remi@remirepo.net> - 8.0.19~RC1-1
- update to 8.0.19RC1
* Wed Apr 13 2022 Remi Collet