Description

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

Remediation

References

CVE-2020-7067

Related Vulnerabilities

WordPress Plugin Ultimate Maps by Supsystic SQL Injection (1.1.12)

WordPress Plugin Easy Social Box/Page Cross-Site Scripting (4.1.2)

Liferay Portal Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-15839)

Ruby on Rails Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2014-3482)

WordPress Plugin WP Symposium Multiple SQL Injection Vulnerabilities (12.09)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-125 CVE-2020-7067