CVE-2018-20783

    Dashboard / Vulnerabilities / CVE-2018-20783

    CVE-2018-20783

    Published: 21 Feb 2019Last Modified: 7 Aug 2026

    Summary:

    Details: In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.

    References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html, http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html, https://usn.ubuntu.com/3566-2/, http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html, http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html, http://php.net/ChangeLog-5.php, http://php.net/ChangeLog-7.php, https://access.redhat.com/errata/RHSA-2019:2519, https://access.redhat.com/errata/RHSA-2019:3299, https://bugs.php.net/bug.php?id=77143

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4653a1b260c9d640a292a9548e8def00edc5ca58

    Affected versions

    POST_PHP7_NSAPI_REMOVAL

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High