CVE-2020-7060: global buffer-overflow in mbfl_filt_conv_big5_wchar
A flaw was found in php before 7.4.2. A global buffer overflow in mbflfiltconvbig5wchar function may lead to corruption of memory data.
Upstream issue:
http://bugs.php.net/79037
Other sources
Fixed bug (global buffer-overflow in mbflfiltconvbig5wchar). (CVE-2020-7060)
— PHP
When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbflfiltconvbig5wchar to read past the allocated buffer. This may lead to information disclosure or crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php73-phpto a version that resolves this vulnerability.Fixed in 0:7.3.20-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.4.2 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.27 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.4.2 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.3.14 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.2.27 - Compensating control
If upgrading is not immediately possible, avoid using mbstring functions that convert multibyte encodings in affected PHP versions (7.2.x below 7.2.27, 7.3.x below 7.3.14, 7.4.x below 7.4.2) to prevent crafted input from reaching mbfl_filt_conv_big5_wchar.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-7060?
CVE-2020-7060 is a fixed bug (global buffer-overflow in `mbfl_filt_conv_big5_wchar`).
What is the severity of CVE-2020-7060?
The severity of CVE-2020-7060 is critical with a CVSS score of 9.1.
Which versions of PHP are affected by CVE-2020-7060?
PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14, and 7.4.x below 7.4.2 are affected by CVE-2020-7060.
How can CVE-2020-7060 be exploited?
CVE-2020-7060 can be exploited by supplying data that will cause the function `mbfl_filt_conv_big5_wchar` to read past the allocated buffer, leading to information disclosure.
What is the remedy for CVE-2020-7060?
To fix CVE-2020-7060, PHP versions 7.2.27, 7.3.14, and 7.4.2 should be installed, depending on the PHP version being used.