SynopsisThe version of PHP running on the remote web server is affected by multiple vulnerabilities.
DescriptionAccording to its banner, the version of PHP running on the remote web server is either 7.2.x prior to 7.2.27, 7.3.x prior to 7.3.14, or 7.4.x prior to 7.4.2. It is, therefore, affected by multiple vulnerabilities:
- An buffer overflow on the mbfl_filt_conv_big5_wchar` function. An unauthenticated, remote attacker can exploit this to leading to the disclosure of information within memory locations and possibly allow for the execution of malicious code. (CVE-2020-7060)
- An out-of-bounds READ error exists in the php_strip_tags_ex due to an input validation error. An unauthenticated, remote attacker can exploit this, leading to the disclosure of information within some memory locations. (CVE-2020-7059)
SolutionUpgrade to PHP version 7.2.27, 7.3.14, 7.4.2 or later.