CVEvulnerability

CVE-2020-7067

7.5 HIGH Published 2020-04-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-04-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-125, CWE-196

Description

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

Affected configurations

• php php (>= 7.2.0 < 7.2.30) • php php (>= 7.3.0 < 7.3.17) • php php (>= 7.4.0 < 7.4.5) • tenable tenable.sc (< 5.19.0) • oracle communications diameter signaling router (>= 8.0.0.0 <= 8.4.0.5) • debian debian linux 9.0 • debian debian linux 10.0

Related

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-196 Unsigned to Signed Conversion Error weakness

References