Vulnerability Description
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 7.2.0, < 7.2.30 |
| Tenable | Tenable.Sc | < 5.19.0 |
| Oracle | Communications Diameter Signaling Router | >= 8.0.0.0, <= 8.4.0.5 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://bugs.php.net/bug.php?id=79465ExploitVendor Advisory
- https://security.netapp.com/advisory/ntap-20200504-0001/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4717Third Party Advisory
- https://www.debian.org/security/2020/dsa-4719Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlNot ApplicableThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
- https://www.tenable.com/security/tns-2021-14PatchThird Party Advisory
- https://bugs.php.net/bug.php?id=79465ExploitVendor Advisory
- https://security.netapp.com/advisory/ntap-20200504-0001/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4717Third Party Advisory
- https://www.debian.org/security/2020/dsa-4719Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlNot ApplicableThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
- https://www.tenable.com/security/tns-2021-14PatchThird Party Advisory
FAQ
What is CVE-2020-7067?
CVE-2020-7067 is a vulnerability with a CVSS score of 7.5 (HIGH). In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated...
How severe is CVE-2020-7067?
CVE-2020-7067 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-7067?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Tenable Tenable.Sc, Oracle Communications Diameter Signaling Router, Debian Debian Linux.