Description

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

Remediation

References

CVE-2020-7060

Related Vulnerabilities

MongoDb Improper Certificate Validation Vulnerability (CVE-2023-1409)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2015-8389)

Oracle JRE CVE-2013-2431 Vulnerability (CVE-2013-2431)

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3499)

WordPress Plugin ExS Widgets Local File Inclusion (0.3.1)

Severity

Critical

Classification

CVE-2020-7060 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Missing Update Known Vulnerabilities