CVE-2020-7068CWE-416

Use of freed hash key in the phar_parse_zipfile function

Medium · published September 9, 2020

CVSS v3.1
4.8
EPSS
2%
Percentile
76.5
In the wild
Unconfirmed
What it is

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01661 · 76.5th percentile
Weakness
CWE-416 · Use After Free
Published
2020-09-09T17:58Z
EPSS history
Timeline
  • 09 SEP 17:58Z
    Use of freed hash key in the phar_parse_zipfile function
    cvelistv5