CVE-2018-20783 — Out-of-bounds Read in PHP

CWE-125 — Out-of-bounds ReadCWE-122 — Heap-based Buffer Overflow15 documents8 sources
Severity
9.8CRITICALNVD
NVD7.5CNA7.5OSV7.5
EPSS
5.1%
top 10.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
PHPPhp5Canonical Ubuntu Linux+2 more
Timeline
PublishedFeb 21
Latest updateJan 27

Description

In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDphp/php7.0.0 — 7.1.26+7
▶Ubuntuphp5/php5< 5.5.9+dfsg-1ubuntu4.27+1
▶NVDopensuse/leap42.3

Also affects: Debian Linux 9.0, Ubuntu Linux 12.04, 14.04, 16.04

🔴Vulnerability Details

7
GHSA
GHSA-gx4f-r59p-mgpx: In PHP before 5↗2022-05-14
▶
GHSA
GHSA-3fr9-q295-2jq3: An issue was discovered in PHP before 5↗2022-05-14
▶
OSV
php5 vulnerabilities↗2019-05-22
▶
CVEList
CVE-2019-9021: An issue was discovered in PHP before 5↗2019-02-22
▶
OSV
CVE-2019-9021: An issue was discovered in PHP before 5↗2019-02-22
▶

📋Vendor Advisories

4
CISA ICS
Festo Didactic SE MES PC↗2026-01-27
▶
Ubuntu
PHP vulnerabilities↗2019-05-22
▶
Red Hat
php: Heap-based buffer over-read in PHAR reading functions↗2018-12-06
▶
Red Hat
php: Buffer over-read in PHAR reading functions↗2018-11-12
▶

💬Community

2
Bugzilla
CVE-2019-9021 php: Heap-based buffer over-read in PHAR reading functions↗2019-03-04
▶
Bugzilla
CVE-2018-20783 php: Buffer over-read in PHAR reading functions↗2019-02-25
▶