CVE-2020-7067
Fixed in a distro release EPSS 4%CVSS 7.5
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
Products: PHP Group PHP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | php7.3 | 7.3.19-1~deb10u1 |
| Debian 11 | php7.4 | 7.4.5-1 |
| Debian 8 | php5 | 5.6.40+dfsg-0+deb8u11 |
| Debian 9 | php7.0 | 7.0.33-0+deb9u8 |