Out-of-bounds read in PHP - CVE-2020-7060

Vulnerability identifier: #VU25110

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7060

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when using certain "mbstring" functions to convert multibyte encodings. A remote attacker can supply data that will cause function "mbfl_filt_conv_big5_wchar" to read past the allocated buffer, trigger out-of-bounds read error and read contents of memory on the system or crash the application.

PHP
Amazon Linux AMI
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Opensuse
openEuler
Fedora
Red Hat Software Collections
Tenable.sc
php7 (Alpine package)
php7.2 (Ubuntu package)
php7.3 (Ubuntu package)
php7.0 (Debian package)
php-json
php-debuginfo
php-xmlrpc
php-gd
php-ldap
php-recode
php-process
php-xml
php-enchant
php-help
php-odbc
php-snmp
php-devel
php-fpm
php-debugsource
php-gmp
php-dbg
php-embedded
php-cli
php-intl
php-opcache
php-mbstring
php-pgsql
php-common
php-bcmath
php-soap
php-pdo
php-tidy
php-mysqlnd
php
php-dba
php7.3 (Debian package)
rh-php73-php (Red Hat package)
Oracle Communications Diameter Signaling Router (DSR)

Install updates from vendor's website.

PHP - addressed in versions 7.2.27, 7.3.14, 7.4.2
Tenable.sc - update to 5.19.0
php7 (Alpine package) - update to 7.2.27-r0
php7.2 (Ubuntu package) - update to 7.2.24-0ubuntu0.18.04.3
php7.0 (Debian package) - update to 7.0.33-0+deb9u7
php-json - addressed in versions 7.2.10-12, 7.2.10-13
php-debuginfo - addressed in versions 7.2.10-12, 7.2.10-13
php-xmlrpc - addressed in versions 7.2.10-12, 7.2.10-13
php-gd - addressed in versions 7.2.10-12, 7.2.10-13
php-ldap - addressed in versions 7.2.10-12, 7.2.10-13
php-recode - addressed in versions 7.2.10-12, 7.2.10-13
php-process - addressed in versions 7.2.10-12, 7.2.10-13
php-xml - addressed in versions 7.2.10-12, 7.2.10-13
php-enchant - addressed in versions 7.2.10-12, 7.2.10-13
php-help - addressed in versions 7.2.10-12, 7.2.10-13
php-odbc - addressed in versions 7.2.10-12, 7.2.10-13
php-snmp - addressed in versions 7.2.10-12, 7.2.10-13
php-devel - addressed in versions 7.2.10-12, 7.2.10-13
php-fpm - addressed in versions 7.2.10-12, 7.2.10-13
php-debugsource - addressed in versions 7.2.10-12, 7.2.10-13
php-gmp - addressed in versions 7.2.10-12, 7.2.10-13
php-dbg - addressed in versions 7.2.10-12, 7.2.10-13
php-embedded - addressed in versions 7.2.10-12, 7.2.10-13
php-cli - addressed in versions 7.2.10-12, 7.2.10-13
php-intl - addressed in versions 7.2.10-12, 7.2.10-13
php-opcache - addressed in versions 7.2.10-12, 7.2.10-13
php-mbstring - addressed in versions 7.2.10-12, 7.2.10-13
php-pgsql - addressed in versions 7.2.10-12, 7.2.10-13
php-common - addressed in versions 7.2.10-12, 7.2.10-13
php-bcmath - addressed in versions 7.2.10-12, 7.2.10-13
php-soap - addressed in versions 7.2.10-12, 7.2.10-13
php-pdo - addressed in versions 7.2.10-12, 7.2.10-13
php-tidy - addressed in versions 7.2.10-12, 7.2.10-13
php-mysqlnd - addressed in versions 7.2.10-12, 7.2.10-13
php - addressed in versions 7.2.10-12, 7.2.10-13
php-dba - addressed in versions 7.2.10-12, 7.2.10-13
php - addressed in versions 7.3.14-1.fc30, 7.3.14-1.fc31
php7.3 (Debian package) - update to 7.3.14-1~deb10u1
rh-php73-php (Red Hat package) - update to 7.3.20-1.el7

• https://bugs.php.net/bug.php?id=79037

• Multiple vulnerabilities in PHP
• Ubuntu update for PHP
• Amazon Linux AMI update for php73
• Amazon Linux AMI update for php72
• OpenSUSE Linux update for php7
• Gentoo update for PHP
• Out-of-bounds read in Oracle Communications Diameter Signaling Router (DSR)
• Out-of-bounds read in php7 (Alpine package)
• Red Hat Software Collections 1 for RHEL 7.7 update for rh-php73-php
• Multiple vulnerabilities in Tenable.sc
• Debian update for php7.3
• Debian update for php7.0
• openEuler 20.03 LTS update for php
• openEuler 20.03 LTS SP1 update for php
• Red Hat Enterprise Linux 8 update for the php:7.3 module
• Fedora 30 update for php
• Fedora 31 update for php