CVE-2020-7060

Опубликовано: 10 фев. 2020

Источник: nvd

CVSS3: 6.5

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html
Mailing List
Third Party Advisory
https://bugs.php.net/bug.php?id=79037
Exploit
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2020/Feb/27
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2020/Feb/31
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2021/Jan/3
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202003-57
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200221-0002/
Mailing List
Third Party Advisory
https://usn.ubuntu.com/4279-1/
Patch
Third Party Advisory
https://www.debian.org/security/2020/dsa-4626
Third Party Advisory
https://www.debian.org/security/2020/dsa-4628
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Third Party Advisory
https://www.tenable.com/security/tns-2021-14
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html
Mailing List
Third Party Advisory
https://bugs.php.net/bug.php?id=79037
Exploit
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2020/Feb/27
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2020/Feb/31
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2021/Jan/3
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Версия от 7.2.0 (включая) до 7.2.27 (исключая)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Версия от 7.3.0 (включая) до 7.3.14 (исключая)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Версия от 7.4.0 (включая) до 7.4.2 (исключая)

Конфигурация 2

cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*

Версия до 5.19.0 (исключая)

Конфигурация 3

cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*

Версия от 8.0 (включая) до 8.4 (включая)

Конфигурация 4

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05579

Низкий

6.5 Medium

CVSS3

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2020-7060

CVSS3: 6.5

ubuntu

больше 5 лет назад

CVE-2020-7060

CVSS3: 6.5

redhat

больше 5 лет назад

CVE-2020-7060

CVSS3: 6.5

debian

больше 5 лет назад

When using certain mbstring functions to convert multibyte encodings, ...

GHSA-ch28-9wjf-88gw

CVSS3: 9.1

github

около 3 лет назад

BDU:2020-05769

CVSS3: 6.5

fstec

больше 5 лет назад

Уязвимость функции mbfl_filt_conv_big5_wchar интерпретатора PHP, позволяющая нарушителю получить доступ к защищаемой информации или вызвать отказ в обслуживании

EPSS

Процентиль: 90%

0.05579

Низкий

6.5 Medium

CVSS3

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-125