What’s Vulnerable › Vulnerabilities
CVE-2020-7068: Use of freed hash key in the phar_parse_zipfile function
- Severity: low (CVSS 3.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-09-09 · updated 2026-06-17
- Weakness: CWE-416
Description
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
Affected products
- Debian Linux: 10.0
- PHP: from 7.2.0 before 7.2.33; from 7.3.0 before 7.3.21; from 7.4.0 before 7.4.9 — fixed in 7.2.33, 7.3.21, 7.4.9
- Tenable.sc: before 5.19.0 — fixed in 5.19.0
How to fix
Upgrade to a fixed version: PHP 7.2.33, 7.3.21, 7.4.9; Tenable.sc 5.19.0. Check the vendor advisory for mitigations.
References
- https://bugs.php.net/bug.php?id=79797
- https://security.gentoo.org/glsa/202009-10
- https://security.netapp.com/advisory/ntap-20200918-0005/
- https://www.debian.org/security/2021/dsa-4856
- https://www.tenable.com/security/tns-2021-14
- https://bugs.php.net/bug.php?id=79797
- https://security.gentoo.org/glsa/202009-10
- https://security.netapp.com/advisory/ntap-20200918-0005/
- https://www.debian.org/security/2021/dsa-4856
- https://www.tenable.com/security/tns-2021-14
Get alerted when CVE-2020-7068 or the next vulnerability affects your stack