VulnerabilityModified

CVE-2020-7067

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as…

HIGH 7.5EPSS 4.31%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 4.31% probability · 91th percentile
CISA KEV: Not listed
Weakness: CWE-125, CWE-196
Affected: php/php · tenable/tenable.sc · oracle/communications diameter signaling router · debian/debian linux
Source: security@php.net

References

https://bugs.php.net/bug.php?id=79465Exploit, Vendor Advisory
https://security.netapp.com/advisory/ntap-20200504-0001/Third Party Advisory
https://www.debian.org/security/2020/dsa-4717Third Party Advisory
https://www.debian.org/security/2020/dsa-4719Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlNot Applicable, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
https://www.tenable.com/security/tns-2021-14Patch, Third Party Advisory
https://bugs.php.net/bug.php?id=79465Exploit, Vendor Advisory
https://security.netapp.com/advisory/ntap-20200504-0001/Third Party Advisory
https://www.debian.org/security/2020/dsa-4717Third Party Advisory
https://www.debian.org/security/2020/dsa-4719Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlNot Applicable, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
https://www.tenable.com/security/tns-2021-14Patch, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.