Vulnerability Description
When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 7.2.0, < 7.2.27 |
| Tenable | Tenable.Sc | < 5.19.0 |
| Oracle | Communications Diameter Signaling Router | >= 8.0, <= 8.4 |
| Opensuse | Leap | 15.1 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.htmlThird Party Advisory
- https://bugs.php.net/bug.php?id=79099ExploitVendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/02/msg00030.htmlThird Party Advisory
- https://seclists.org/bugtraq/2020/Feb/27Mailing ListThird Party Advisory
- https://seclists.org/bugtraq/2020/Feb/31Mailing ListThird Party Advisory
- https://seclists.org/bugtraq/2021/Jan/3Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202003-57Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200221-0002/Third Party Advisory
- https://usn.ubuntu.com/4279-1/PatchThird Party Advisory
- https://www.debian.org/security/2020/dsa-4626Third Party Advisory
- https://www.debian.org/security/2020/dsa-4628Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
- https://www.tenable.com/security/tns-2021-14PatchThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.htmlThird Party Advisory
FAQ
What is CVE-2020-7059?
CVE-2020-7059 is a vulnerability with a CVSS score of 6.5 (MEDIUM). When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function ...
How severe is CVE-2020-7059?
CVE-2020-7059 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-7059?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Tenable Tenable.Sc, Oracle Communications Diameter Signaling Router, Opensuse Leap, Debian Debian Linux.