BIT-php-2020-7059
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/php/BIT-php-2020-7059.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-php-2020-7059
- Aliases
- Published
- 2024-03-06T11:07:56.497Z
- Modified
- 2024-03-06T11:25:28.861Z
- Summary
- [none]
- Details
-
When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.
- References
-
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html
- https://bugs.php.net/bug.php?id=79099
- https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html
- https://seclists.org/bugtraq/2020/Feb/27
- https://seclists.org/bugtraq/2020/Feb/31
- https://seclists.org/bugtraq/2021/Jan/3
- https://security.gentoo.org/glsa/202003-57
- https://security.netapp.com/advisory/ntap-20200221-0002/
- https://usn.ubuntu.com/4279-1/
- https://www.debian.org/security/2020/dsa-4626
- https://www.debian.org/security/2020/dsa-4628
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.tenable.com/security/tns-2021-14
Affected packages
Bitnami / php
Package
- Name
- php
- Purl
- pkg:bitnami/php
Severity
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator