CVE-2020-7068

Description

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.

Weakness classification

• security@php.net: CWE-416
• nvd@nist.gov: CWE-416

Primary references

• security@php.net — Exploit, Mailing List, Patch, Vendor Advisory
• security@php.net — Third Party Advisory
• security@php.net — Third Party Advisory
• security@php.net — Third Party Advisory
• security@php.net — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Patch, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory