CVE-2020-7067
OOB Read in urldecode()
En bref Sévérité HIGH 7.5 EPSS EPSS 4.31 % · centile 91 (2026-10-28) État PUBLISHED Publiée 2020-04-27 Mise à jour 2024-09-17 Attribuée par php Statut NVD Modified Description In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N php CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N NVD · security@php.net (Secondary) CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.30cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.3.0 < 7.3.17cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.5cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* < 5.19.0cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* ≥ 8.0.0.0 ≤ 8.4.0.5cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*Produits affectés Produit Versions PHP Group · PHP affected 7.2.x below 7.2.30 ; affected 7.3.x below 7.3.17 and 7.4.x below 7.4.5
Références
Sources
