Description
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHP Group | PHP | 7.3.x – < 7.3.15, 7.4.x – < 7.4.3 | 7.3.15 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.15 | php7 | 7.3.15-r0 | — |
| Alpine v3.14 | php7 | 7.3.15-r0 | — |
| Alpine v3.13 | php7 | 7.3.15-r0 | — |
| Alpine v3.12 | php7 | 7.3.15-r0 | — |
| Alpine v3.11 | php7 | 7.3.15-r0 | — |
Advisories 3
- FSA-202302 Festo: Several vulnerabilities in FactoryViews CERT@VDE · Feb 2, 2026
- ICSA-26-027-02 Festo Didactic SE MES PC CISA ICS & IT advisories · Jan 27, 2026
- FSA-202402 Several Vulnerabilities in MES PC (Windows 10) CERT@VDE · Dec 8, 2025