CVE-2020-7061: heap-buffer-overflow in phar_extract_file
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
Other sources
Fixed bug (heap-buffer-overflow in pharextractfile). (CVE-2020-7061)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.3.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.3.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.4.3
Event History
Frequently Asked Questions
What is CVE-2020-7061?
CVE-2020-7061 is a fixed bug in PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3 that could cause a heap-buffer-overflow in phar_extract_file.
What is the severity of CVE-2020-7061?
CVE-2020-7061 has a severity rating of 9.1 (critical).
How does CVE-2020-7061 affect software?
CVE-2020-7061 affects PHP versions 7.2.0 to 7.2.27, 7.3.0 to 7.3.14, and 7.4.0 to 7.4.2.
What are the potential impacts of CVE-2020-7061?
CVE-2020-7061 could potentially lead to information disclosure or crash.
Where can I find more information about CVE-2020-7061?
More information about CVE-2020-7061 can be found at the following references: [link1], [link2], [link3].