CVE-2020-7061

Description

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Weakness classification

• security@php.net: CWE-125
• nvd@nist.gov: CWE-125

Primary references

• security@php.net — Exploit, Vendor Advisory
• security@php.net — Third Party Advisory
• security@php.net — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory