CVE-2020-7065CWE-121

mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full

High · published April 1, 2020

CVSS v3.1
7.4
EPSS
5%
Percentile
92.0
In the wild
Unconfirmed
What it is

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04883 · 92.0th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2020-04-01T03:35Z
EPSS history
Timeline
  • 01 APR 03:35Z
    mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full
    cvelistv5