BIT-php-2020-7068

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/php/BIT-php-2020-7068.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-php-2020-7068

Aliases

CVE-2020-7068

Published

2024-03-06T11:06:18.071Z

Modified

2024-11-27T19:40:48.342Z

Summary

[none]

Details

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, pharparsezipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.

Database specific

{
    "cpes": [
        "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

https://bugs.php.net/bug.php?id=79797
https://security.gentoo.org/glsa/202009-10
https://security.netapp.com/advisory/ntap-20200918-0005/
https://www.debian.org/security/2021/dsa-4856
https://www.tenable.com/security/tns-2021-14

Affected packages

Bitnami / php

Package

Name: php
Purl: pkg:bitnami/php

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

7.2.0

Fixed

7.2.33

Introduced

7.3.0

Fixed

7.3.21

Introduced

7.4.0

Fixed

7.4.9