CVE-2020-7060 Information
Share on:Description
When using certain mbstring functions to convert multibyte encodings in PHP versions 7.2.x below 7.2.27 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Reference
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html https://bugs.php.net/bug.php?id=79037 https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html https://seclists.org/bugtraq/2020/Feb/27 https://seclists.org/bugtraq/2020/Feb/31 https://security.gentoo.org/glsa/202003-57 https://security.netapp.com/advisory/ntap-20200221-0002/ https://usn.ubuntu.com/4279-1/ https://www.debian.org/security/2020/dsa-4626 https://www.debian.org/security/2020/dsa-4628 https://www.oracle.com/security-alerts/cpujul2020.html
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
HIGH
Base Severity
9.1