BIT-libphp-2020-7061

vendorUSosv

heap-buffer-overflow in phar_extract_file

view advisory published 2025-08-11Licence: per source

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-7061US	critical9.1	4.08% (91st)	—	2020-02-27
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read…

references

External citations — patches, advisories, analysis.

https://bugs.php.net/bug.php?id=79171ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-7061WEB
https://security.gentoo.org/glsa/202003-57ADVISORY
https://www.tenable.com/security/tns-2021-14ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan