CVEvulnerability
CVE-2020-7060
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-02-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:P
- Weaknesses
- CWE-125
Description
When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
Affected configurations
• php php (>= 7.2.0 < 7.2.27)
• php php (>= 7.3.0 < 7.3.14)
• php php (>= 7.4.0 < 7.4.2)
• tenable tenable.sc (< 5.19.0)
• oracle communications diameter signaling router (>= 8.0 <= 8.4)
• opensuse leap 15.1
• debian debian linux 8.0
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html Mailing List, Third Party Advisory
- https://bugs.php.net/bug.php?id=79037 Exploit, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Feb/31 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2021/Jan/3 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202003-57 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200221-0002/ Mailing List, Third Party Advisory
- https://usn.ubuntu.com/4279-1/ Patch, Third Party Advisory
- https://www.debian.org/security/2020/dsa-4626 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4628 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory
- https://www.tenable.com/security/tns-2021-14 Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html Mailing List, Third Party Advisory
- https://bugs.php.net/bug.php?id=79037 Exploit, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Feb/31 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2021/Jan/3 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202003-57 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200221-0002/ Mailing List, Third Party Advisory
- https://usn.ubuntu.com/4279-1/ Patch, Third Party Advisory
- https://www.debian.org/security/2020/dsa-4626 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4628 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory
- https://www.tenable.com/security/tns-2021-14 Patch, Third Party Advisory