crítica
CVE-2020-7061
php: heap-based buffer overflow in phar_extract_file
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según Amazon (media), Red Hat (baja).
Descripción
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | libphp, php, php-min | 7.2.28, 7.3.15, 7.4.3 |
| alpine 3.11 | php7 | 7.3.15-r0 |
| alpine 3.12 | php7 | 7.3.15-r0 |
| alpine 3.13 | php7 | 7.3.15-r0 |
| alpine 3.14 | php7 | 7.3.15-r0 |
| alpine 3.15 | php7 | 7.3.15-r0 |
| amazon linux 1 | php72, php72-bcmath, php72-cli y 61 más | 7.2.28-1.21.amzn1 y 1 más |
Mostrar las 72 entradas de 7 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | libphp | 7.2.28, 7.3.15, 7.4.3 |
| bitnami::Bitnami Vulnerability Database | php | 7.2.28, 7.3.15, 7.4.3 |
| bitnami::Bitnami Vulnerability Database | php-min | 7.2.28, 7.3.15, 7.4.3 |
| alpine 3.11 | php7 | 7.3.15-r0 |
| alpine 3.12 | php7 | 7.3.15-r0 |
| alpine 3.13 | php7 | 7.3.15-r0 |
| alpine 3.14 | php7 | 7.3.15-r0 |
| alpine 3.15 | php7 | 7.3.15-r0 |
| amazon linux 1 | php72 | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-bcmath | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-cli | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-common | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-dba | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-dbg | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-debuginfo | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-devel | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-embedded | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-enchant | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-fpm | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-gd | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-gmp | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-imap | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-intl | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-json | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-ldap | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-mbstring | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-mysqlnd | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-odbc | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-opcache | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-pdo | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-pdo-dblib | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-pgsql | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-process | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-pspell | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-recode | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-snmp | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-soap | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-tidy | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-xml | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php72-xmlrpc | 7.2.28-1.21.amzn1 |
| amazon linux 1 | php73 | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-bcmath | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-cli | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-common | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-dba | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-dbg | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-debuginfo | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-devel | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-embedded | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-enchant | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-fpm | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-gd | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-gmp | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-imap | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-intl | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-json | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-ldap | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-mbstring | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-mysqlnd | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-odbc | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-opcache | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-pdo | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-pdo-dblib | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-pgsql | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-process | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-pspell | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-recode | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-snmp | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-soap | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-tidy | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-xml | 7.3.15-1.24.amzn1 |
| amazon linux 1 | php73-xmlrpc | 7.3.15-1.24.amzn1 |