kritisch
CVE-2020-7061
php: heap-based buffer overflow in phar_extract_file
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami. Niedriger laut Amazon (mittel), Red Hat (niedrig).
Beschreibung
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | libphp, php, php-min | 7.2.28, 7.3.15, 7.4.3 |
| alpine 3.11 | php7 | 7.3.15-r0 |
| alpine 3.12 | php7 | 7.3.15-r0 |
| alpine 3.13 | php7 | 7.3.15-r0 |
| alpine 3.14 | php7 | 7.3.15-r0 |
| alpine 3.15 | php7 | 7.3.15-r0 |
| amazon linux 1 | php72, php72-bcmath, php72-cli und 61 weitere | 7.2.28-1.21.amzn1 und 1 weitere |
Alle 72 Einträge aus 7 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | libphp | 7.2.28, 7.3.15, 7.4.3 |
| bitnami::Bitnami Vulnerability Database | php | 7.2.28, 7.3.15, 7.4.3 |
| bitnami::Bitnami Vulnerability Database | php-min | 7.2.28, 7.3.15, 7.4.3 |
| alpine 3.11 | php7 | 7.3.15-r0 |
| alpine 3.12 | php7 | 7.3.15-r0 |
| alpine 3.13 | php7 | 7.3.15-r0 |
| alpine 3.14 | php7 | 7.3.15-r0 |
| alpine 3.15 | php7 | 7.3.15-r0 |
| amazon linux 1 | php72 | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-bcmath | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-cli | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-common | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-dba | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-dbg | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-debuginfo | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-devel | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-embedded | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-enchant | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-fpm | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-gd | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-gmp | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-imap | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-intl | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-json | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-ldap | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-mbstring | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-mysqlnd | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-odbc | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-opcache | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-pdo | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-pdo-dblib | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-pgsql | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-process | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-pspell | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-recode | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-snmp | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-soap | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-tidy | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-xml | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-xmlrpc | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php73 | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-bcmath | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-cli | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-common | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-dba | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-dbg | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-debuginfo | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-devel | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-embedded | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-enchant | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-fpm | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-gd | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-gmp | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-imap | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-intl | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-json | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-ldap | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-mbstring | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-mysqlnd | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-odbc | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-opcache | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-pdo | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-pdo-dblib | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-pgsql | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-process | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-pspell | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-recode | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-snmp | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-soap | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-tidy | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-xml | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-xmlrpc | 7.3.15-1.24.amzn1 |