CVE-2018-20783

In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to pharparsepharfile in ext/phar/phar.c.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*"
            ],
            "vendor_product": "opensuse:leap",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "42.3"
                }
            ]
        }
    ]
}

References

CVE-2018-20783

Affected packages