Memory Access Vulnerability in PHP Packages: CVE-2020-7068
Summary
UBUNTU-CVE-2020-7068: In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash... Affects php5 versions < 5.5.9+dfsg-1ubuntu4.29+esm14. Fixed in 5.5.9+dfsg-1ubuntu4.29+esm14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. The affected packages include various PHP versions (5, 7.0, 7.2, 7.3, and 7.4) that are integral to running PHP applications. This vulnerability arises from improper handling of PHAR files, which can lead to serious security issues.
Vulnerability Detail
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21, and 7.4.x below 7.4.9, a flaw exists in the phar extension that allows phar_parse_zipfile to be tricked into accessing freed memory. This could lead to a crash or information disclosure, potentially exposing sensitive data or causing application instability. The vulnerability has a CVSS score of 3.6, indicating a low to moderate severity.
How To Fix
Minimum fixed version
5.5.9+dfsg-1ubuntu4.29+esm14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the PHAR extension in your PHP configuration until the package is updated. This can be done by commenting out the line 'extension=phar.so' in your php.ini file.
Conclusion
CVE-2020-7068 presents a significant risk to PHP applications due to improper handling of PHAR files. It is crucial to update affected PHP packages to their patched versions to mitigate this vulnerability and ensure the security of your applications.
See every vulnerability recorded for php5 →
FAQ
CVE-2020-7068 is a vulnerability in PHP that allows for potential memory access issues when processing PHAR files.
The affected versions include PHP 7.2.x below 7.2.33, 7.3.x below 7.3.21, and 7.4.x below 7.4.9.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability may lead to application crashes or unauthorized access to sensitive information.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
