CVE-2020-7060CWE-125

global buffer-overflow in mbfl_filt_conv_big5_wchar

Medium · published February 10, 2020

CVSS v3.1
6.5
EPSS
9%
Percentile
95.2
In the wild
Unconfirmed
What it is

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.08888 · 95.2th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2020-02-10T07:45Z
EPSS history
Timeline
  • 10 FEB 07:45Z
    global buffer-overflow in mbfl_filt_conv_big5_wchar
    cvelistv5