UpHeron
All vulnerabilities

Servers and applications

CVE-2020-7067

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

Severity
High 7.5
Published
27 Apr 2020
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Fixed in
7.2.30, 7.3.17, 7.4.5
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 7.2.0 before 7.2.30
  • From 7.3.0 before 7.3.17
  • From 7.4.0 before 7.4.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-7067
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-7067