CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 1CVE-2020-7067 – OOB Read in urldecode()
https://notcve.org/view.php?id=CVE-2020-7067
27 Apr 2020 — In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes. En PHP versiones 7.2.x por debajo de 7.2.30, versiones 7.3.x debajo de 7.3.17 y versiones 7.4.x por debajo de 7.4.5, si PHP es compilado con soporte EBCDIC (poco común), la función urldecode() puede ser hecha para acceder a ubicaciones más allá ... • https://bugs.php.net/bug.php?id=79465 • CWE-125: Out-of-bounds Read CWE-196: Unsigned to Signed Conversion Error •
CVSS: 5.3EPSS: 0%CPEs: 9EXPL: 1CVE-2020-7066 – get_headers() silently truncates after a null byte
https://notcve.org/view.php?id=CVE-2020-7066
27 Mar 2020 — In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server. En las versiones de PHP 7.2.x anterior a la versión 7.2.29, 7.3.x anterior a 7.3.16 y 7.4.x anterior a 7.4.4, mientras usa get_headers () con la URL s... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.html • CWE-170: Improper Null Termination CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 1CVE-2020-7064 – Use-of-uninitialized-value in exif
https://notcve.org/view.php?id=CVE-2020-7064
27 Mar 2020 — In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash. En PHP versiones 7.2.x por debajo de 7.2.9, versiones 7.3.x por debajo de 7.3.16 y versiones 7.4.x por debajo de 7.4.4, al analizar datos EXIF ??con la función exif_read_data(), es posible que unos datos maliciosos causen que ... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.html • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 1CVE-2020-7063 – Files added to tar with Phar::buildFromIterator have all-access permissions
https://notcve.org/view.php?id=CVE-2020-7063
27 Feb 2020 — In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted. En PHP versiones 7.2.x por debajo de 7.2.28, versiones 7.3.x por debajo de 7.3.15 y versiones 7.4.x por debajo... • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html • CWE-281: Improper Preservation of Permissions CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 1CVE-2020-7062 – Null Pointer Dereference in PHP Session Upload Progress
https://notcve.org/view.php?id=CVE-2020-7062
27 Feb 2020 — In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash. En PHP versiones 7.2.x por debajo de 7.2.28, versiones 7.3.x por debajo de 7.3.15 y versiones 7.4.x por debajo de 7.4.3, cuan... • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html • CWE-476: NULL Pointer Dereference •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 1CVE-2020-7061 – heap-buffer-overflow in phar_extract_file
https://notcve.org/view.php?id=CVE-2020-7061
27 Feb 2020 — In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash. En PHP versiones 7.3.x por debajo de 7.3.15 y versiones 7.4.x por debajo de 7.4.3, mientras son extraídos los archivos PHAR en Windows usando la extensión phar, determinado contenido dentro del archivo PHAR podría conllevar a una lectura de ... • https://bugs.php.net/bug.php?id=79171 • CWE-125: Out-of-bounds Read •
CVSS: 9.1EPSS: 0%CPEs: 7EXPL: 1CVE-2020-7060 – global buffer-overflow in mbfl_filt_conv_big5_wchar
https://notcve.org/view.php?id=CVE-2020-7060
10 Feb 2020 — When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash. Cuando se usan determinadas funciones de mbstring para convertir codificaciones multibyte, en PHP versiones 7.2.x por debajo de 7.2.27, versiones 7.3.x por debajo de 7.3.14 y versiones 7.4.x por deba... • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 9.1EPSS: 0%CPEs: 7EXPL: 1CVE-2020-7059 – OOB read in php_strip_tags_ex
https://notcve.org/view.php?id=CVE-2020-7059
10 Feb 2020 — When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash. Cuando se usa la función fgetss() para leer datos con etiquetas de eliminación, en PHP versiones 7.2.x por debajo de 7.2.27, versiones 7.3.x por debajo de 7.3.14 y versiones 7.4.x por debajo de 7.4.2, es posible suministrar dat... • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 1CVE-2019-11050 – Use-after-free in exif parsing under memory sanitizer
https://notcve.org/view.php?id=CVE-2019-11050
23 Dec 2019 — When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. Cuando la extensión PHP EXIF se encuentra analizando información EXIF de una imagen, por ejemplo por medio de la función exif_read_data(), en PHP versiones 7.2.x por debajo de 7.2.26, versiones 7.3.x po... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 1CVE-2019-11047 – Heap-buffer-overflow READ in exif
https://notcve.org/view.php?id=CVE-2019-11047
23 Dec 2019 — When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. Cuando la extensión EXIF de PHP está analizando información EXIF de una imagen, por ejemplo por medio de la función exif_read_data(), PHP versiones 7.2.x por debajo de 7.2.26, versiones 7.3.x por debajo... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html • CWE-125: Out-of-bounds Read •