CVE-2020-7065

Katalog CVE

CVSS 8.8 · High EPSS 4,9%

Kerentanan Stack-based Buffer Overflow pada php, debian linux +2 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.

Rincian

Terbit di NVD

1 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

4,9% peluang dieksploitasi; lebih tinggi dari 91,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.php.net/bug.php?id=79371 exploit · issue tracking · patch · advisory vendor
• https://www.php.net/ChangeLog-7.php#7.4.4 release notes · advisory vendor
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200403-0001/ advisory pihak ketiga
• https://usn.ubuntu.com/4330-1/ advisory pihak ketiga
• https://usn.ubuntu.com/4330-2/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4719 advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-14 advisory pihak ketiga