CVE-2020-7067

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "8.0.0.0"
                        },
                        {
                            "last_affected":  "8.4.0.5"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "oracle:communications_diameter_signaling_router"
        },
        {
            "cpes":  [
                "cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "5.19.0"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "tenable:tenable.sc"
        },
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "9.0"
                        },
                        {
                            "last_affected":  "9.0"
                        },
                        {
                            "introduced":  "10.0"
                        },
                        {
                            "last_affected":  "10.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "debian:debian_linux"
        }
    ]
}

References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type

GIT

Repo

https://github.com/php/php-src

Events

Introduced

8148cbb78841c8ec0759c0836e7f35dec799d300

Fixed

a516aa0d2c75a2e3dd9214fb75c2a16c1c534a82

Introduced

52ace952a1b65ca80fc2617f11c2fa6dd03f51bd

Fixed

2c0d56cc150ada2355319c418c0c6e8321ef7b0f

Introduced

3c7824e16ec4c3cee417262445d2c2b66531c10f

Fixed

ab4d1893fa762f1d73601de2644963a7501b1c95

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.2.0"
                },
                {
                    "fixed":  "7.2.30"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.3.0"
                },
                {
                    "fixed":  "7.3.17"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.4.0"
                },
                {
                    "fixed":  "7.4.5"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7067.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "40565887675130562443727052077638606803",
            "length":  475
        },
        "id":  "CVE-2020-7067-1cafb47a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/php/php-src/commit/2c0d56cc150ada2355319c418c0c6e8321ef7b0f",
        "target":  {
            "file":  "ext/standard/url.c",
            "function":  "php_raw_url_decode"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "229641027241768780455332400035790589213",
                "325167784308788717541731998735878028213",
                "192017146838867819246149091574669861050",
                "149578118580867487196755427987601782041",
                "229641027241768780455332400035790589213",
                "325167784308788717541731998735878028213",
                "192017146838867819246149091574669861050",
                "149578118580867487196755427987601782041"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2020-7067-96d24e0b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/php/php-src/commit/2c0d56cc150ada2355319c418c0c6e8321ef7b0f",
        "target":  {
            "file":  "ext/standard/url.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "181543715275648914325665755639281675361",
            "length":  518
        },
        "id":  "CVE-2020-7067-b285b1b5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/php/php-src/commit/2c0d56cc150ada2355319c418c0c6e8321ef7b0f",
        "target":  {
            "file":  "ext/standard/url.c",
            "function":  "php_url_decode"
        }
    }
]

vanir_signatures_modified

"2026-10-24T14:19:46Z"