{"id":"CVE-2020-7061","aliases":["ALPINE-CVE-2020-7061","BIT-libphp-2020-7061","BIT-php-2020-7061","BIT-php-min-2020-7061","EUVD-2020-28195","GHSA-q6h5-x7cx-j9jg","MGASA-2020-0119"],"status":"published","title":"heap-buffer-overflow in phar_extract_file","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.04075,"percentile":0.90783,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2020-02-27T20:25:14Z","modified":"2026-11-03T06:32:26Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"php7","fixed_in":["7.3.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"php7","fixed_in":["7.3.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"php7","fixed_in":["7.3.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"php7","fixed_in":["7.3.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"php7","fixed_in":["7.3.15-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libphp","fixed_in":["7.2.28","7.3.15","7.4.3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php","fixed_in":["7.2.28","7.3.15","7.4.3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php-min","fixed_in":["7.2.28","7.3.15","7.4.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.15-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"libphp","ranges":[{"type":"SEMVER","events":[{"introduced":"7.2.0"},{"fixed":"7.2.28"},{"introduced":"7.3.0"},{"fixed":"7.3.15"},{"introduced":"7.4.0"},{"fixed":"7.4.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php","ranges":[{"type":"SEMVER","events":[{"introduced":"7.2.0"},{"fixed":"7.2.28"},{"introduced":"7.3.0"},{"fixed":"7.3.15"},{"introduced":"7.4.0"},{"fixed":"7.4.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php-min","ranges":[{"type":"SEMVER","events":[{"introduced":"7.2.0"},{"fixed":"7.2.28"},{"introduced":"7.3.0"},{"fixed":"7.3.15"},{"introduced":"7.4.0"},{"fixed":"7.4.3"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.15-1.mga7"}]}],"bundled":3}],"products":[{"vendor":"php","product":"php"},{"vendor":"php group","product":"php"},{"vendor":"tenable","product":"tenable.sc"}],"references":[{"url":"https://bugs.php.net/bug.php?id=79171","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","advisory","evidence"]},{"url":"https://security.gentoo.org/glsa/202003-57","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2021-14","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7061","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q6h5-x7cx-j9jg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-7061","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0119.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26234","tags":["report"]},{"url":"https://www.php.net/ChangeLog-7.php#7.3.15","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-7061","title":"heap-buffer-overflow in phar_extract_file","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","status":"published","published":"2020-02-27T20:25:14.751Z","modified":"2024-09-17T01:21:01.352Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2020-28195","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","status":"published","published":"2020-02-27T20:25:14Z","modified":"2024-09-17T01:21:01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:50.749865Z"}],"ghsa":[{"id":"GHSA-q6h5-x7cx-j9jg","title":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows...","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","status":"published","published":"2022-05-24T17:09:51Z","modified":"2023-01-29T05:01:40Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:44:53.095202Z"}],"nvd":[{"id":"CVE-2020-7061","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","status":"published","published":"2020-02-27T21:15:18.927Z","modified":"2026-06-17T03:24:17.22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:54.796125Z"}],"osv":[{"id":"ALPINE-CVE-2020-7061","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","status":"published","published":"2020-02-27T21:15:18.927Z","modified":"2026-11-03T06:32:26.238456159Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-7061","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","status":"published","published":"2020-02-27T21:15:18.927Z","modified":"2026-10-24T10:30:23.754533244Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"BIT-libphp-2020-7061","title":"heap-buffer-overflow in phar_extract_file","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","status":"published","published":"2025-08-11T13:52:59.804Z","modified":"2026-09-08T08:48:08.024970912Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-php-2020-7061","title":"heap-buffer-overflow in phar_extract_file","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","status":"published","published":"2024-03-06T11:07:32.612Z","modified":"2026-09-08T08:48:18.116129749Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"BIT-php-min-2020-7061","title":"heap-buffer-overflow in phar_extract_file","description":"In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.","status":"published","published":"2025-01-14T19:24:09.708Z","modified":"2026-09-08T08:48:24.700749113Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"MGASA-2020-0119","title":"Updated php packages fix bugs and security vulnerabilities","description":"Updated php packages fix bugs and security vulnerabilities:\n\nCore:\n- Fixed bug #71876 (Memory corruption htmlspecialchars(): charset `*'\n  not supported).\n- Fixed bug #79146 (cscript can fail to run on some systems).\n- Fixed bug #78323 (Code 0 is returned on invalid options).\n- Fixed bug #76047 (Use-after-free when accessing already destructed\n  backtrace arguments).\nCURL:\n- Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()).\nIntl:\n- Fixed bug #79212 (NumberFormatter::format() may detect wrong type).\nLibxml:\n- Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()).\nMBString:\n- Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding).\nMySQLnd:\n- Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH).\nOpenSSL:\n- Fixed bug #79145 (openssl memory leak).\nPhar:\n- Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have\n  all-access permissions). (CVE-2020-7063)\n- Fixed bug #79171 (heap-buffer-overflow in phar_extract_file).\n  (CVE-2020-7061)\n- Fixed bug #76584 (PharFileInfo::decompress not working).\nReflection:\n- Fixed bug #79115 (ReflectionClass::isCloneable call reflected class\n  __destruct).\nSession:\n- Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload\n  Progress). (CVE-2020-7062)\nSPL:\n- Fixed bug #79151 (heap use after free caused by\n  spl_dllist_it_helper_move_forward).\nStandard:\n- Fixed bug #78902 (Memory leak when using stream_filter_append).\nXSL:\n- Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory).\n","status":"published","published":"2020-03-06T16:13:58Z","modified":"2026-04-16T04:43:19.60016051Z","updated_at":"2026-11-02T15:49:41.151324Z"}]}}