CVE-2020-7067: 
PHP vulnerability analysis and mitigation

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes (PHP Bug, NVD).

The vulnerability occurs when CHARSET_EBCDIC is defined (usually on systems with EBCDIC encoding support). The issue stems from casting hex values to signed char type instead of unsigned char when used as array indexes in the urldecode() function. This allows insertion of negative hex values to access memory locations before the array (PHP Bug). The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information through out-of-bounds memory access (NetApp Advisory).

The vulnerability is remotely exploitable without authentication, meaning it can be exploited over a network without requiring user credentials. However, it only affects PHP installations compiled with EBCDIC support, which is uncommon (NVD).

The vulnerability has been fixed in PHP versions 7.2.30, 7.3.17, and 7.4.5. Users should upgrade to these or later versions to address the issue. The fix involves using unsigned char type for array indexing (PHP Bug).