CVE-2020-7061 MEDIUM

CVE-2020-7061: heap-buffer-overflow in phar_extract_file

Vendor Php Group
Product PHP
Weakness CWE-125
Published February 27, 2020
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

What the vulnerability does

01Description

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Key dates

02Disclosure timeline

February 27, 2020 CVE published
September 17, 2024 Record updated