CVE-2020-7061CWE-125

heap-buffer-overflow in phar_extract_file

Medium · published February 27, 2020

CVSS v3.1
6.5
EPSS
4%
Percentile
90.6
In the wild
Unconfirmed
What it is

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.04075 · 90.6th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2020-02-27T20:25Z
EPSS history
Timeline
  • 27 FEB 20:25Z
    heap-buffer-overflow in phar_extract_file
    cvelistv5