CVE-2020-7060

Description

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html

https://bugs.php.net/bug.php?id=79037

https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html

https://seclists.org/bugtraq/2020/Feb/27

https://seclists.org/bugtraq/2020/Feb/31

https://seclists.org/bugtraq/2021/Jan/3

https://security.gentoo.org/glsa/202003-57

https://security.netapp.com/advisory/ntap-20200221-0002/

https://usn.ubuntu.com/4279-1/

https://www.debian.org/security/2020/dsa-4626

https://www.debian.org/security/2020/dsa-4628

https://www.oracle.com/security-alerts/cpuApr2021.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.tenable.com/security/tns-2021-14

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3