Out-of-bounds read in PHP - CVE-2020-7067

Vulnerability identifier: #VU26979

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7067

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing untrusted input passed to urldecode() PHP function. A remote attacker can send specially crafted data to the application that uses the affected function and gain access to sensitive information on the system

PHP
Amazon Linux AMI
Debian Linux
openEuler
Tenable.sc
php7.0 (Debian package)
php7 (Alpine package)
php-pgsql
php-fpm
php-gd
php-help
php-mysqlnd
php-bcmath
php-snmp
php-mbstring
php-devel
php-debugsource
php-odbc
php-recode
php-xmlrpc
php-debuginfo
php-soap
php-pdo
php-process
php-opcache
php
php-gmp
php-json
php-tidy
php-common
php-intl
php-dba
php-xml
php-embedded
php-cli
php-enchant
php-dbg
php-ldap
php7.3 (Debian package)

Install updates from vendor's website.

PHP - addressed in versions 7.2.30, 7.3.17, 7.4.5
Tenable.sc - update to 5.19.0
php7.0 (Debian package) - update to 7.0.33-0+deb9u8
php7 (Alpine package) - update to 7.3.17-r0
php-pgsql - update to 7.2.10-19
php-fpm - update to 7.2.10-19
php-gd - update to 7.2.10-19
php-help - update to 7.2.10-19
php-mysqlnd - update to 7.2.10-19
php-bcmath - update to 7.2.10-19
php-snmp - update to 7.2.10-19
php-mbstring - update to 7.2.10-19
php-devel - update to 7.2.10-19
php-debugsource - update to 7.2.10-19
php-odbc - update to 7.2.10-19
php-recode - update to 7.2.10-19
php-xmlrpc - update to 7.2.10-19
php-debuginfo - update to 7.2.10-19
php-soap - update to 7.2.10-19
php-pdo - update to 7.2.10-19
php-process - update to 7.2.10-19
php-opcache - update to 7.2.10-19
php - update to 7.2.10-19
php-gmp - update to 7.2.10-19
php-json - update to 7.2.10-19
php-tidy - update to 7.2.10-19
php-common - update to 7.2.10-19
php-intl - update to 7.2.10-19
php-dba - update to 7.2.10-19
php-xml - update to 7.2.10-19
php-embedded - update to 7.2.10-19
php-cli - update to 7.2.10-19
php-enchant - update to 7.2.10-19
php-dbg - update to 7.2.10-19
php-ldap - update to 7.2.10-19
php7.3 (Debian package) - update to 7.3.19-1~deb10u1

• https://www.php.net/ChangeLog-7.php#7.3.17
• https://bugs.php.net/bug.php?id=79465

• Information disclosure in PHP
• Amazon Linux AMI update for php72
• Amazon Linux AMI update for php73
• Debian update for php7.0
• Out-of-bounds read in php7 (Alpine package)
• Multiple vulnerabilities in Tenable.sc
• Debian update for php7.3
• openEuler 20.03 LTS SP1 update for php