Malformed phar file with cache configuration leads freed memory as hash key when it inserts into the hash table. More detail information and original report is here: https://bugs.php.net/bug.php?id=79797 and it was assigned CVE-2020-7068. ## Impact Through this vulnerability that inserts freed memory into the hash table that manages alias file names, an attacker may gain memory information.

Related CVEs

Associated Common Vulnerabilities and Exposures

CVE-2020-7068 MEDIUM

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Use After Free