Description

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

Remediation

References

CVE-2020-7059

Related Vulnerabilities

Dot CMS Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2016-3972)

Oracle Database Server CVE-2021-2173 Vulnerability (CVE-2021-2173)

WordPress Plugin Smart Marketing SMS and Newsletters Forms Security Bypass (2.6.1)

Python Integer Overflow or Wraparound Vulnerability (CVE-2008-3144)

WordPress Plugin WP to Twitter Security Bypass (3.2.19)

Severity

Critical

Classification

CVE-2020-7059 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Missing Update Known Vulnerabilities