CVE-2020-7061 Information
Share on:
Feb 14, 2021
cve
Description
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3 while extracting PHAR files on Windows using phar extension certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Reference
https://bugs.php.net/bug.php?id=79171 https://security.gentoo.org/glsa/202003-57
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
HIGH
Base Severity
9.1