Every CVE Search/ Get API key

CVE-2020-7061

heap-buffer-overflow in phar_extract_file

6.5 MediumFix available

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

4.08%Down 2.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.5

heap-buffer-overflow in phar_extract_file

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Record
CVE-2020-7061
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2020-28195 6.5

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Record
EUVD-2020-28195
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-q6h5-x7cx-j9jg 9.1

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows...

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Record
GHSA-q6h5-x7cx-j9jg
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 6.5

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Record
CVE-2020-7061
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2020-7061 9.1

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Record
ALPINE-CVE-2020-7061
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-03
OSV 9.1

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Record
CVE-2020-7061
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVBIT-libphp-2020-7061 No score

heap-buffer-overflow in phar_extract_file

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Record
BIT-libphp-2020-7061
Updated
2026-11-02
OSVBIT-php-2020-7061 No score

heap-buffer-overflow in phar_extract_file

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Record
BIT-php-2020-7061
Updated
2026-11-02
OSVBIT-php-min-2020-7061 No score

heap-buffer-overflow in phar_extract_file

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Record
BIT-php-min-2020-7061
Updated
2026-11-02
OSVMGASA-2020-0119 No score

Updated php packages fix bugs and security vulnerabilities

Updated php packages fix bugs and security vulnerabilities:

Core:

  • Fixed bug #71876 (Memory corruption htmlspecialchars(): charset `*' not supported).
  • Fixed bug #79146 (cscript can fail to run on some systems).
  • Fixed bug #78323 (Code 0 is returned on invalid options).
  • Fixed bug #76047 (Use-after-free when accessing already destructed backtrace arguments). CURL:
  • Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()). Intl:
  • Fixed bug #79212 (NumberFormatter::format() may detect wrong type). Libxml:
  • Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()). MBString:
  • Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding). MySQLnd:
  • Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH). OpenSSL:
  • Fixed bug #79145 (openssl memory leak). Phar:
  • Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063)
  • Fixed bug #79171 (heap-buffer-overflow in phar_extract_file). (CVE-2020-7061)
  • Fixed bug #76584 (PharFileInfo::decompress not working). Reflection:
  • Fixed bug #79115 (ReflectionClass::isCloneable call reflected class __destruct). Session:
  • Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062) SPL:
  • Fixed bug #79151 (heap use after free caused by spl_dllist_it_helper_move_forward). Standard:
  • Fixed bug #78902 (Memory leak when using stream_filter_append). XSL:
  • Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory).
Record
MGASA-2020-0119
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php7
Alpine:v3.11
 before 7.3.15-r0
7.3.15-r0
php7
Alpine:v3.12
 before 7.3.15-r0
7.3.15-r0
php7
Alpine:v3.13
 before 7.3.15-r0
7.3.15-r0
php7
Alpine:v3.14
 before 7.3.15-r0
7.3.15-r0
php7
Alpine:v3.15
 before 7.3.15-r0
7.3.15-r0
libphp
Bitnami
 7.2.0 up to 7.2.28, 7.3.0 up to 7.3.15, 7.4.0 up to 7.4.3
7.2.287.3.157.4.3
php
Bitnami
 7.2.0 up to 7.2.28, 7.3.0 up to 7.3.15, 7.4.0 up to 7.4.3
7.2.287.3.157.4.3
php-min
Bitnami
 7.2.0 up to 7.2.28, 7.3.0 up to 7.3.15, 7.4.0 up to 7.4.3
7.2.287.3.157.4.3
php
Mageia:7
From an advisory covering 3 CVEs
 before 7.3.15-1.mga7
7.3.15-1.mga7

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-7061 is a medium vulnerability (CVSS 6.5) in Php, published February 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.08%, the 90th percentile. Fixed in php7 7.3.15-r0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open