본문 바로가기
← PHP 소식
PHP 8.3.14보안

PHP 8.3.14 변경 기록과 적용 점검

릴리스: 2024년 11월 21일

게시: 2026년 8월 6일

PHP 8.3.14 공식 변경 기록에서 구성요소와 CVE를 추출하고 사용 환경별 확인 순서를 제공합니다.

PHP 8.3.14 변경 사항

공식 php-src 태그의 NEWS에서 이 버전의 항목만 추출했습니다. 아래 구성요소와 확인 순서는 원문에 따라 자동 구성됩니다. 애플리케이션 호환성이나 취약점 영향 여부를 판정하지 않습니다.

변경된 구성요소

CLI · COM · Core · Curl · Date · DBA · DOM · EXIF · FFI · Filter · FPM · GD · GMP · LDAP · MBstring · MySQLnd · Opcache · OpenSSL · PDO DBLIB · PDO Firebird · PDO ODBC · Phar · PHPDBG · Reflection · Session · SOAP · Sockets · SPL · Standard · Streams · SysVMsg · SysVShm · XMLReader · Zlib

원문에 명시된 CVE

사용 환경별 확인 순서

  • php -v와 php -m으로 실제 실행 버전과 확장 목록을 확인하고 아래 원문에서 사용 중인 구성요소의 변경을 찾으세요.
  • composer check-platform-reqs로 설치 환경의 요구사항을 확인하세요. 성공하더라도 동작 호환성까지 보장하지는 않습니다.
  • 날짜·시간대를 사용한다면 Carbon 및 날짜 변환 테스트에서 변경 항목과 관련된 입력을 점검하세요.
  • PHP-FPM을 사용한다면 스테이징에서 프로세스 재시작과 오류 로그를 확인하세요.
  • PDO를 사용한다면 실제 데이터베이스 드라이버로 조회·트랜잭션 테스트를 실행하세요.
  • TLS 연결을 사용한다면 외부 API·메일 서버 연결과 인증서 검증을 점검하세요.
  • GD를 사용한다면 이미지 업로드·리사이즈 처리를 실제 파일로 확인하세요.
  • 배포 전 스테이징에서 애플리케이션 테스트를 실행하고, 배포 후 웹 프로세스와 큐 워커가 새 PHP를 사용하는지 확인하세요.

공식 변경 기록

21 Nov 2024, PHP 8.3.14

  • CLI: . Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server started through shebang). (ilutov) . Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface). (nielsdos)

  • COM: . Fixed out of bound writes to SafeArray data. (cmb)

  • Core: . Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled with Xcode 16 clang on macOS 15). (nielsdos) . Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646). (Arnaud) . Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline). (ilutov) . Fixed bug GH-16509 (Incorrect line number in function redeclaration error). (ilutov) . Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed early bound classes). (ilutov) . Fixed bug GH-16648 (Use-after-free during array sorting). (ilutov)

  • Curl: . Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if curl_multi_add_handle fails). (timwolla)

  • Date: . Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset). (cmb) . Fixed bug GH-14732 (date_sun_info() fails for non-finite values). (cmb)

  • DBA: . Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams). (cmb)

  • DOM: . Fixed bug GH-16316 (DOMXPath breaks when not initialized properly). (nielsdos) . Add missing hierarchy checks to replaceChild. (nielsdos) . Fixed bug GH-16336 (Attribute intern document mismanagement). (nielsdos) . Fixed bug GH-16338 (Null-dereference in ext/dom/node.c). (nielsdos) . Fixed bug GH-16473 (dom_import_simplexml stub is wrong). (nielsdos) . Fixed bug GH-16533 (Segfault when adding attribute to parent that is not an element). (nielsdos) . Fixed bug GH-16535 (UAF when using document as a child). (nielsdos) . Fixed bug GH-16593 (Assertion failure in DOM->replaceChild). (nielsdos) . Fixed bug GH-16595 (Another UAF in DOM -> cloneNode). (nielsdos)

  • EXIF: . Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a real file). (nielsdos, cmb)

  • FFI: . Fixed bug GH-16397 (Segmentation fault when comparing FFI object). (nielsdos)

  • Filter: . Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen). (cmb)

  • FPM: . Fixed bug GH-16628 (FPM logs are getting corrupted with this log statement). (nielsdos)

  • GD: . Fixed bug GH-16334 (imageaffine overflow on matrix elements). (David Carlier) . Fixed bug GH-16427 (Unchecked libavif return values). (cmb) . Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007). (nielsdos)

  • GMP: . Fixed floating point exception bug with gmp_pow when using large exposant values. (David Carlier). . Fixed bug GH-16411 (gmp_export() can cause overflow). (cmb) . Fixed bug GH-16501 (gmp_random_bits() can cause overflow). (David Carlier) . Fixed gmp_pow() overflow bug with large base/exponents. (David Carlier) . Fixed segfaults and other issues related to operator overloading with GMP objects. (Girgias)

  • LDAP: . Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932) (nielsdos)

  • MBstring: . Fixed bug GH-16361 (mb_substr overflow on start/length arguments). (David Carlier)

  • MySQLnd: . Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929) (Jakub Zelenka)

  • Opcache: . Fixed bug GH-16408 (Array to string conversion warning emitted in optimizer). (ilutov)

  • OpenSSL: . Fixed bug GH-16357 (openssl may modify member types of certificate arrays). (cmb) . Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow). (cmb) . Fix various memory leaks on error conditions in openssl_x509_parse(). (nielsdos)

  • PDO DBLIB: . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236) (nielsdos)

  • PDO Firebird: . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236) (nielsdos)

  • PDO ODBC: . Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values). (cmb)

  • Phar: . Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808). (nielsdos)

  • PHPDBG: . Fixed bug GH-16174 (Empty string is an invalid expression for ev). (cmb)

  • Reflection: . Fixed bug GH-16601 (Memory leak in Reflection constructors). (nielsdos)

  • Session: . Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params). (nielsdos) . Fixed bug GH-16290 (overflow on cookie_lifetime ini value). (David Carlier)

  • SOAP: . Fixed bug GH-16318 (Recursive array segfaults soap encoding). (nielsdos) . Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient). (nielsdos)

  • Sockets: . Fixed bug with overflow socket_recvfrom $length argument. (David Carlier)

  • SPL: . Fixed bug GH-16337 (Use-after-free in SplHeap). (nielsdos) . Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()). (ilutov) . Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov) . Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()). (ilutov) . Fixed bug GH-16588 (UAF in Observer->serialize). (nielsdos) . Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor). (Girgias) . Fixed bug GH-16589 (UAF in SplDoublyLinked->serialize()). (nielsdos) . Fixed bug GH-14687 (segfault on SplObjectIterator instance). (David Carlier) . Fixed bug GH-16604 (Memory leaks in SPL constructors). (nielsdos) . Fixed bug GH-16646 (UAF in ArrayObject::unset() and ArrayObject::exchangeArray()). (ilutov)

  • Standard: . Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with bail enabled). (ilutov)

  • Streams: . Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234) (Jakub Zelenka) . Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233) (nielsdos)

  • SysVMsg: . Fixed bug GH-16592 (msg_send() crashes when a type does not properly serialized). (David Carlier / cmb)

  • SysVShm: . Fixed bug GH-16591 (Assertion error in shm_put_var). (nielsdos, cmb)

  • XMLReader: . Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c). (nielsdos)

  • Zlib: . Fixed bug GH-16326 (Memory management is broken for bad dictionaries.) (cmb)

출처

PHP 8.3.14 공식 NEWS · 현재 PHP 지원 일정

원문에 없는 지원 종료일, CVE, Laravel 호환성 결론은 자동으로 추가하지 않습니다.

php.net 공식 릴리스 노트 보기 →