Description
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- PHP Group / PHP7.2.x below 7.2.30 – 7.2.x below 7.2.30
- PHP Group / PHP7.3.x below 7.3.17 and 7.4.x below 7.4.5 – 7.3.x below 7.3.17 and 7.4.x below 7.4.5
References
- VENDOR_ADVISORYhttps://www.debian.org/security/2020/dsa-4717
- VENDOR_ADVISORYhttps://www.debian.org/security/2020/dsa-4719
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
- MISChttps://bugs.php.net/bug.php?id=79465
- MISChttps://security.netapp.com/advisory/ntap-20200504-0001/
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
- MISChttps://www.tenable.com/security/tns-2021-14