| Name | CVE-2020-7067 |
| Description | In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2188-1, DSA-4717-1, DSA-4719-1, ELA-227-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| php5 (PTS) | jessie, jessie (lts) | 5.6.40+dfsg-0+deb8u21 | fixed |
| php7.0 (PTS) | stretch (security) | 7.0.33-0+deb9u12 | fixed |
| stretch (lts), stretch | 7.0.33-0+deb9u19 | fixed | |
| php7.3 (PTS) | buster, buster (lts) | 7.3.31-1~deb10u8 | fixed |
| buster (security) | 7.3.31-1~deb10u7 | fixed | |
| php7.4 (PTS) | bullseye | 7.4.33-1+deb11u5 | fixed |
| bullseye (security) | 7.4.33-1+deb11u7 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| php5 | source | wheezy | 5.4.45-0+deb7u29 | ELA-227-1 | ||
| php5 | source | jessie | 5.6.40+dfsg-0+deb8u11 | DLA-2188-1 | ||
| php5 | source | (unstable) | (unfixed) | unimportant | ||
| php7.0 | source | stretch | 7.0.33-0+deb9u8 | DSA-4717-1 | ||
| php7.0 | source | (unstable) | (unfixed) | unimportant | ||
| php7.3 | source | buster | 7.3.19-1~deb10u1 | DSA-4719-1 | ||
| php7.3 | source | (unstable) | (unfixed) | unimportant | ||
| php7.4 | source | (unstable) | 7.4.5-1 | unimportant |
Fixed in PHP 7.4.5, 7.3.17
PHP Bug: https://bugs.php.net/79465
https://git.php.net/?p=php-src.git;a=commit;h=9d6bf8221b05f86ce5875832f0f646c4c1f218be
This only affects builds which enable EDBDIC