CVE-2020-7067
OOB Read in urldecode()
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
En PHP versiones 7.2.x por debajo de 7.2.30, versiones 7.3.x debajo de 7.3.17 y versiones 7.4.x por debajo de 7.4.5, si PHP es compilado con soporte EBCDIC (poco común), la función urldecode() puede ser hecha para acceder a ubicaciones más allá del memoria asignada, debido al uso erróneo de números con signo como índices de matriz.
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in information disclosure, denial of service or potentially the execution of arbitrary code.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-15 CVE Reserved
- 2020-04-27 CVE Published
- 2024-09-17 CVE Updated
- 2024-09-17 First Exploit
- 2025-04-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
- CWE-196: Unsigned to Signed Conversion Error
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20200504-0001 | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpuApr2021.html | Not Applicable |
|
| https://www.oracle.com/security-alerts/cpuoct2020.html | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://bugs.php.net/bug.php?id=79465 | 2024-09-17 |
| URL | Date | SRC |
|---|---|---|
| https://www.tenable.com/security/tns-2021-14 | 2022-05-16 |
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2020/dsa-4717 | 2022-05-16 | |
| https://www.debian.org/security/2020/dsa-4719 | 2022-05-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 7.2.0 < 7.2.30 Search vendor "Php" for product "Php" and version " >= 7.2.0 < 7.2.30" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 7.3.0 < 7.3.17 Search vendor "Php" for product "Php" and version " >= 7.3.0 < 7.3.17" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 7.4.0 < 7.4.5 Search vendor "Php" for product "Php" and version " >= 7.4.0 < 7.4.5" | - |
Affected
| ||||||
| Tenable Search vendor "Tenable" | Tenable.sc Search vendor "Tenable" for product "Tenable.sc" | < 5.19.0 Search vendor "Tenable" for product "Tenable.sc" and version " < 5.19.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Diameter Signaling Router Search vendor "Oracle" for product "Communications Diameter Signaling Router" | >= 8.0.0.0 <= 8.4.0.5 Search vendor "Oracle" for product "Communications Diameter Signaling Router" and version " >= 8.0.0.0 <= 8.4.0.5" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||