High
Security advisory
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-7067
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:22 UTC · Revision 1
Source evidence
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
osv:CVE-2020-7067
Complete source record
{
"id": "aef800ffe21fd8e24ed478be76390c8f74b9688b73e0bf2dc2cf536304c97d7b",
"url": "https://osv.dev/vulnerability/CVE-2020-7067",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-7067",
"summary": "In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.",
"evidence": "osv:CVE-2020-7067",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-7067",
"aliases": [
"BIT-libphp-2020-7067",
"BIT-php-2020-7067",
"BIT-php-min-2020-7067",
"CVE-2020-7067"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/php/php-src",
"type": "GIT",
"events": [
{
"introduced": "8148cbb78841c8ec0759c0836e7f35dec799d300"
},
{
"fixed": "a516aa0d2c75a2e3dd9214fb75c2a16c1c534a82"
},
{
"introduced": "52ace952a1b65ca80fc2617f11c2fa6dd03f51bd"
},
{
"fixed": "2c0d56cc150ada2355319c418c0c6e8321ef7b0f"
},
{
"introduced": "3c7824e16ec4c3cee417262445d2c2b66531c10f"
},
{
"fixed": "ab4d1893fa762f1d73601de2644963a7501b1c95"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.30"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.0"
},
{
"fixed": "7.3.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.4.0"
},
{
"fixed": "7.4.5"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7067.json",
"vanir_signatures": [
{
"id": "CVE-2020-7067-1cafb47a",
"digest": {
"length": 475,
"function_hash": "40565887675130562443727052077638606803"
},
"source": "https://github.com/php/php-src/commit/2c0d56cc150ada2355319c418c0c6e8321ef7b0f",
"target": {
"file": "ext/standard/url.c",
"function": "php_raw_url_decode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-7067-96d24e0b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"229641027241768780455332400035790589213",
"325167784308788717541731998735878028213",
"192017146838867819246149091574669861050",
"149578118580867487196755427987601782041",
"229641027241768780455332400035790589213",
"325167784308788717541731998735878028213",
"192017146838867819246149091574669861050",
"149578118580867487196755427987601782041"
]
},
"source": "https://github.com/php/php-src/commit/2c0d56cc150ada2355319c418c0c6e8321ef7b0f",
"target": {
"file": "ext/standard/url.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-7067-b285b1b5",
"digest": {
"length": 518,
"function_hash": "181543715275648914325665755639281675361"
},
"source": "https://github.com/php/php-src/commit/2c0d56cc150ada2355319c418c0c6e8321ef7b0f",
"target": {
"file": "ext/standard/url.c",
"function": "php_url_decode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:19:46Z"
}
}
],
"modified": "2026-10-24T14:19:46.812428757Z",
"provider": "osv",
"references": [
"https://security.netapp.com/advisory/ntap-20200504-0001/",
"https://www.debian.org/security/2020/dsa-4717",
"https://www.debian.org/security/2020/dsa-4719",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://www.tenable.com/security/tns-2021-14",
"https://bugs.php.net/bug.php?id=79465"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_diameter_signaling_router",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0.0"
},
{
"last_affected": "8.4.0.5"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*"
],
"vendor_product": "tenable:tenable.sc",
"extracted_events": [
{
"range": [
{
"fixed": "5.19.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-7067",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443487,
"published_at": "2020-04-27T21:15:14.593+00:00"
}