CVE-2020-7059 Information
Share on:Description
When using fgetss() function to read data with stripping tags in PHP versions 7.2.x below 7.2.27 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Reference
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html https://bugs.php.net/bug.php?id=79099 https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html https://seclists.org/bugtraq/2020/Feb/27 https://seclists.org/bugtraq/2020/Feb/31 https://security.gentoo.org/glsa/202003-57 https://security.netapp.com/advisory/ntap-20200221-0002/ https://usn.ubuntu.com/4279-1/ https://www.debian.org/security/2020/dsa-4626 https://www.debian.org/security/2020/dsa-4628 https://www.oracle.com/security-alerts/cpujul2020.html
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
HIGH
Base Severity
9.1