PT-2020-19365 · Php+1 · Php+1

Cmb · Published 2020-02-21 · Updated 2025-08-11 · CVE-2020-7061

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions PHP versions 7.3.x through 7.3.14 PHP versions 7.4.x through 7.4.2

Description The issue arises when extracting PHAR files on Windows using the phar extension. Certain content inside a PHAR file could lead to a one-byte read past the allocated buffer, potentially resulting in information disclosure or a crash.

Recommendations For PHP versions 7.3.x through 7.3.14, update to version 7.3.15 or later. For PHP versions 7.4.x through 7.4.2, update to version 7.4.3 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2020-1304

ALT-PU-2020-1385

BIT-LIBPHP-2020-7061

BIT-PHP-2020-7061

BIT-PHP-MIN-2020-7061

CVE-2020-7061

MGASA-2020-0119

Affected Products

Alt Linux

Php

References · 12

• 🔥 https://bugs.php.net/bug.php?id=79171 · Exploit
• https://osv.dev/vulnerability/BIT-php-2020-7061 · Vendor Advisory
• https://tenable.com/security/tns-2021-14 · Patch
• https://advisories.mageia.org/MGASA-2020-0119.html · Security Note
• https://osv.dev/vulnerability/CVE-2020-7061 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-57 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7061 · Security Note
• https://osv.dev/vulnerability/BIT-php-min-2020-7061 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0119 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-libphp-2020-7061 · Vendor Advisory
• https://php.net/ChangeLog-7.php#7.3.15 · Note
• https://bugs.mageia.org/show_bug.cgi?id=26234 · Note