Back to Database
Status published
Medium
CVE-2020-7068
Use of freed hash key in the phar_parse_zipfile function
Vulnerability Description
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-7068
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- grigoritchy at gmail dot com
References
More from PHP Group
View All →CVE-2025-6491
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Medium
5.9
CVE-2025-1861
Stream HTTP wrapper truncates redirect location to 1024 bytes
Medium
6.3
CVE-2025-1736
Stream HTTP wrapper header check might omit basic auth header
Medium
6.3
CVE-2025-1735
pgsql extension does not check for errors during escaping
Medium
5.9
CVE-2025-1734
Streams HTTP wrapper does not fail for headers with invalid name and no colon
Medium
6.3
Affected Vendor
PHP Group
View all reports →Affected Software
PHP
Vulnerable Versions:
7.3.x, 7.4.x, 7.2.x
Timeline
Official Publish:
September 9th, 2020
Last Modified:
September 17th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L