CVE-2020-7067: OOB Read in urldecode()
Fixed bug (OOB Read in urldecode()). (CVE-2020-7067)
Other sources
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-7067?
CVE-2020-7067 is a vulnerability in PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17, and 7.4.x below 7.4.5 that allows the urldecode() function to access memory locations beyond the allocated memory.
How can the CVE-2020-7067 vulnerability be exploited?
The CVE-2020-7067 vulnerability can be exploited by making the urldecode() function access locations beyond the allocated memory, if PHP is compiled with EBCDIC support and incorrectly uses signed numbers as array indexes.
What is the severity of CVE-2020-7067?
CVE-2020-7067 has a severity rating of 7.5 (high).
Which versions of PHP are affected by CVE-2020-7067?
PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17, and 7.4.x below 7.4.5 are affected by CVE-2020-7067.
How can I fix the CVE-2020-7067 vulnerability?
To fix the CVE-2020-7067 vulnerability, update PHP to version 7.2.30, 7.3.17, or 7.4.5 depending on the currently installed version.