PHP Security Center

Information Disclosure

CVE-2020-7068 php: Use of freed hash key in the phar_parse_zipfile function

Cross-Site Request Forgery

CVE-2020-7070 php: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

Information Disclosure

out-of-bounds read when using a malformed url-encoded string

Information Disclosure

information disclosure in exif_read_data() function

Remote Code Execution

by using mb_strtolower() function with UTF-32LE encoding leads to potential code execution

Remote File Inclusion

information disclosure in function get_headers

Denial of Service

NULL pointer dereference in PHP session upload progress

Information Disclosure

heap-based buffer overflow in phar_extract_file

Information Disclosure

Out of bounds read in php_strip_tags_ex

Information Disclosure

Global buffer-overflow in mbfl_filt_conv_big5_wchar function