Description

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Remediation

References

CVE-2020-7061

Related Vulnerabilities

Joomla CVE-2012-0819 Vulnerability (CVE-2012-0819)

WordPress 5.2.x Multiple Vulnerabilities (5.2 - 5.2.15)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9758)

WordPress Plugin WooCommerce Predictive Search Cross-Site Scripting (1.0.5)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-3550)

Severity

Critical

Classification

CVE-2020-7061 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Missing Update Known Vulnerabilities