CVE-2020-7059: OOB read in php_strip_tags_ex
A flaw was found in php before 7.4.2. An out of bounds read in phpstriptagsex may lead to denial of service or potentially disclosure of sensitive data.
Upstream issue:
https://bugs.php.net/79099
Other sources
Fixed bug (OOB read in phpstriptagsex). (CVE-2020-7059)
— PHP
When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php73-phpto a version that resolves this vulnerability.Fixed in 0:7.3.20-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.4.2 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.27 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.4.2Patch CVE-2020-7059
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-7059?
CVE-2020-7059 is a vulnerability in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14, and 7.4.x below 7.4.2 that allows an attacker to cause the fgetss() function to read past the allocated buffer, leading to information disclosure or crash.
What is the severity of CVE-2020-7059?
The severity of CVE-2020-7059 is critical with a CVSS score of 9.1.
How can I check if my PHP version is affected by CVE-2020-7059?
You can check if your PHP version is affected by CVE-2020-7059 by comparing it with the vulnerable versions: 7.2.x below 7.2.27, 7.3.x below 7.3.14, and 7.4.x below 7.4.2.
How do I fix CVE-2020-7059?
To fix CVE-2020-7059, you need to update your PHP version to at least 7.2.27, 7.3.14, or 7.4.2, depending on the branch you are using.
Where can I find more information about CVE-2020-7059?
You can find more information about CVE-2020-7059 in the references provided: [Reference 1](https://bugs.php.net/79099), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1797777), [Reference 3](http://git.php.net/?p=php-src.git;a=commit;h=0f79b1bf301f455967676b5129240140c5c45b09).