Description
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP to Twitter Cross-Site Scripting (3.0.5)
Moodle Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2018-1133)
Jetty Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2021-28163)
Apache HTTP Server Out-of-bounds Write Vulnerability (CVE-2021-39275)