PHP up to 7.2.26/7.3.13/7.4.1 Multibyte Encoding mbfl_filt_conv_big5_wchar out-of-bounds

Summaryinfo

A vulnerability was found in PHP up to 7.2.26/7.3.13/7.4.1. It has been declared as critical. This vulnerability affects the function mbfl_filt_conv_big5_wchar of the component Multibyte Encoding Handler. Such manipulation leads to out-of-bounds. This vulnerability is traded as CVE-2020-7060. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in PHP up to 7.2.26/7.3.13/7.4.1 (Programming Language Software). Affected by this issue is the function mbfl_filt_conv_big5_wchar of the component Multibyte Encoding Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

The weakness was shared 02/10/2020. This vulnerability is handled as CVE-2020-7060 since 01/15/2020. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 7.2.27, 7.3.14 or 7.4.2 eliminates this vulnerability.

The entry VDB-158119 is related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Name

• PHP

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.9
• 7.2.10
• 7.2.11
• 7.2.12
• 7.2.13
• 7.2.14
• 7.2.15
• 7.2.16
• 7.2.17
• 7.2.18
• 7.2.19
• 7.2.20
• 7.2.21
• 7.2.22
• 7.2.23
• 7.2.24
• 7.2.25
• 7.2.26
• 7.3.0
• 7.3.1
• 7.3.2
• 7.3.3
• 7.3.4
• 7.3.5
• 7.3.6
• 7.3.7
• 7.3.8
• 7.3.9
• 7.3.10
• 7.3.11
• 7.3.12
• 7.3.13
• 7.4.0
• 7.4.1

License

• open-source

Website

• Product: https://www.php.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion