Vulnerability Description
When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 7.2.0, < 7.2.27 |
| Tenable | Tenable.Sc | < 5.19.0 |
| Oracle | Communications Diameter Signaling Router | >= 8.0, <= 8.4 |
| Opensuse | Leap | 15.1 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.htmlMailing ListThird Party Advisory
- https://bugs.php.net/bug.php?id=79037ExploitPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/02/msg00030.htmlMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2020/Feb/27Mailing ListThird Party Advisory
- https://seclists.org/bugtraq/2020/Feb/31Mailing ListThird Party Advisory
- https://seclists.org/bugtraq/2021/Jan/3Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202003-57Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200221-0002/Mailing ListThird Party Advisory
- https://usn.ubuntu.com/4279-1/PatchThird Party Advisory
- https://www.debian.org/security/2020/dsa-4626Third Party Advisory
- https://www.debian.org/security/2020/dsa-4628Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
- https://www.tenable.com/security/tns-2021-14PatchThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2020-7060?
CVE-2020-7060 is a vulnerability with a CVSS score of 6.5 (MEDIUM). When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause functio...
How severe is CVE-2020-7060?
CVE-2020-7060 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-7060?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Tenable Tenable.Sc, Oracle Communications Diameter Signaling Router, Opensuse Leap, Debian Debian Linux.