CVE-2020-7059

Katalog CVE

CVSS 9.1 · Critical EPSS 7,4%

Kerentanan Out-of-bounds Read pada php, tenable.sc +3 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

Rincian

Terbit di NVD

10 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

7,4% peluang dieksploitasi; lebih tinggi dari 94,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.php.net/bug.php?id=79099 exploit · advisory vendor
• https://usn.ubuntu.com/4279-1/ patch · advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-14 patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html advisory pihak ketiga
• https://seclists.org/bugtraq/2020/Feb/27 mailing list · advisory pihak ketiga
• https://seclists.org/bugtraq/2020/Feb/31 mailing list · advisory pihak ketiga
• https://seclists.org/bugtraq/2021/Jan/3 mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202003-57 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200221-0002/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4626 advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4628 advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuApr2021.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2020.html advisory pihak ketiga