Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2020-7061

heap-buffer-overflow in phar_extract_file

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

  • 7.3.x to < 7.3.15affected
  • 7.4.x to < 7.4.3affected

References