CVE-2020-7063

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.

Link	Resource
https://bugs.php.net/bug.php?id=79082	Exploit Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html	Third Party Advisory
https://security.gentoo.org/glsa/202003-57	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00034.html	Third Party Advisory
https://usn.ubuntu.com/4330-1/	Third Party Advisory
https://www.debian.org/security/2020/dsa-4717	Third Party Advisory
https://www.debian.org/security/2020/dsa-4719	Third Party Advisory
https://www.tenable.com/security/tns-2021-14	Patch Third Party Advisory

Configuration 1

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:* cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

---

Published : 2020-02-27 09:15

Updated : 2022-05-08 11:50

---

NVD link : CVE-2020-7063

Mitre link : CVE-2020-7063

No products.

CWE-281

Improper Preservation of Permissions