Description

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

Remediation

References

CVE-2020-7067

Related Vulnerabilities

ClipBucket Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2013-10040)

WordPress Plugin LearnPress-WordPress LMS Cross-Site Scripting (4.1.6.5)

WordPress Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3383)

TYPO3 Improper Input Validation Vulnerability (CVE-2010-4068)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-8139)

Severity

High

Classification

CVE-2020-7067 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities