CVE-2020-7067
- Source
- https://cve.org/CVERecord?id=CVE-2020-7067
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7067.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-7067
- Aliases
- Downstream
- Related
- Published
- 2020-04-27T21:15:14.593Z
- Modified
- 2026-02-05T05:38:12.379110Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
- References
-
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://bugs.php.net/bug.php?id=79465
- https://security.netapp.com/advisory/ntap-20200504-0001/
- https://www.debian.org/security/2020/dsa-4717
- https://www.debian.org/security/2020/dsa-4719
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.tenable.com/security/tns-2021-14
- https://www.tenable.com/security/tns-2021-14
- https://bugs.php.net/bug.php?id=79465
Affected packages
Git / github.com/php/php-src
Database specific
vanir_signatures
[
{
"deprecated": false,
"source": "https://github.com/php/php-src/commit/2c0d56cc150ada2355319c418c0c6e8321ef7b0f",
"id": "CVE-2020-7067-1cafb47a",
"target": {
"file": "ext/standard/url.c",
"function": "php_raw_url_decode"
},
"digest": {
"function_hash": "40565887675130562443727052077638606803",
"length": 475.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/php/php-src/commit/2c0d56cc150ada2355319c418c0c6e8321ef7b0f",
"id": "CVE-2020-7067-96d24e0b",
"target": {
"file": "ext/standard/url.c"
},
"digest": {
"line_hashes": [
"229641027241768780455332400035790589213",
"325167784308788717541731998735878028213",
"192017146838867819246149091574669861050",
"149578118580867487196755427987601782041",
"229641027241768780455332400035790589213",
"325167784308788717541731998735878028213",
"192017146838867819246149091574669861050",
"149578118580867487196755427987601782041"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/php/php-src/commit/2c0d56cc150ada2355319c418c0c6e8321ef7b0f",
"id": "CVE-2020-7067-b285b1b5",
"target": {
"file": "ext/standard/url.c",
"function": "php_url_decode"
},
"digest": {
"function_hash": "181543715275648914325665755639281675361",
"length": 518.0
},
"signature_type": "Function",
"signature_version": "v1"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7067.json"