CVE-2020-7067

OOB Read in urldecode()

State: Published
Severity: 7.5 High
Published: Apr 27, 2020
Updated: Sep 17, 2024
Reserved: Jan 15, 2020

Description

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	php

Weaknesses

CWE-125 Out-of-bounds Read
CWE-196 Unsigned to Signed Conversion Error

Affected Products

Product	Versions
PHPPHP Group	7.2.x below 7.2.30Affected 7.3.x below 7.3.17 and 7.4.x below 7.4.5Affected

References

DSA-4717vendor-advisory
DSA-4719vendor-advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
https://bugs.php.net/bug.php?id=79465
https://security.netapp.com/advisory/ntap-20200504-0001/
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.tenable.com/security/tns-2021-14

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.