Description
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
Remediation
References
Related Vulnerabilities
WordPress Plugin Dropdown and scrollable Text Cross-Site Scripting (2.0)
WordPress Plugin Product Catalog Privilege Escalation (3.8.1)
Plone CMS Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-4198)
CakePHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3712)
WordPress Plugin Simple File List Cross-Site Scripting (4.4.11)