CVE-2020-7068: Use of freed hash key in the phar_parse_zipfile function
Published Aug 3, 2020
·Updated
Fixed bug (Use of freed hash key in the pharparsezipfile function). (CVE-2020-7068)
Other sources
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, pharparsezipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
Affected Software
8 affected componentsFixes available
debian/php7.3
7.3.31-1~deb10u17.3.31-1~deb10u5
debian/php7.4
7.4.33-1+deb11u4
PHP PHP<7.2.33
7.2.33
PHP PHP>=7.2.0<7.2.33
PHP PHP>=7.3.0<7.3.21
PHP PHP>=7.4.0<7.4.9
Debian Debian Linux=10.0
Tenable Tenable.Sc<5.19.0
Remediation
Patch Available
Patch Available
Event History
Aug 6, 2020
CVE Published
via PHP·12:00 AM
Sep 9, 2020
CVE Published
via MITRE·05:58 PM
Data Sourced
via MITRE·05:58 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2020-7068?
CVE-2020-7068 is a vulnerability in PHP that allows for the use of a freed hash key in the phar_parse_zipfile function.
2
How does CVE-2020-7068 affect PHP?
CVE-2020-7068 affects PHP versions up to and excluding 7.2.33.
3
What is the severity of CVE-2020-7068?
The severity of CVE-2020-7068 is not specified.
4
How can I fix CVE-2020-7068?
To fix CVE-2020-7068, update PHP to version 7.2.33 or later.
5
Where can I find more information about CVE-2020-7068?
More information about CVE-2020-7068 can be found in the PHP ChangeLog at https://www.php.net/ChangeLog-7.php#7.2.33.