CVE-2020-7067: Debian Linux

High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days.

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.4.0.5
• PHP PHP: from 7.2.0, before 7.2.30 (fixed in 7.2.30); from 7.3.0, before 7.3.17 (fixed in 7.3.17); from 7.4.0, before 7.4.5 (fixed in 7.4.5)
• Tenable Tenable.sc: before 5.19.0 (fixed in 5.19.0)

Published 2020-04-27. Last modified 2026-06-17.