CVE-2020-7060
Published: 10 February 2020
When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
Priority
Medium
CVSS 3 base score: 9.1
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Released
(5.5.9+dfsg-1ubuntu4.29+esm10)
|
|
|
Patches: Upstream: https://github.com/microsoft/php-src/commit/31b5f3736519f3cb1af875f22f70423934a636d6 |
||
|
php7.0 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Released
(7.0.33-0ubuntu0.16.04.11)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
php7.2 Launchpad, Ubuntu, Debian |
Upstream |
Released
(7.2.27)
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Released
(7.2.24-0ubuntu0.18.04.3)
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
Patches: Upstream: http://git.php.net/?p=php-src.git;a=commit;h=2bcbc95f033c31b00595ed39f79c3a99b4ed0501 |
||
|
php7.3 Launchpad, Ubuntu, Debian |
Upstream |
Released
(7.3.14)
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
Patches: Upstream: http://git.php.net/?p=php-src.git;a=commit;h=2bcbc95f033c31b00595ed39f79c3a99b4ed0501 Upstream: http://git.php.net/?p=php-src.git;a=commit;h=25ec7eb3463f34a2be666c6785d1c6b3cc89575e |
||