blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2020-7059

CRITICAL 9.1 CVSS 3.1
Published
February 10, 2020
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-125
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Description

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

Affected products and versions

  • PHP — From 7.2.0 (including) to 7.2.27 (excluding)
  • PHP — From 7.3.0 (including) to 7.3.14 (excluding)
  • PHP — From 7.4.0 (including) to 7.4.2 (excluding)

References

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html Third Party Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=79099 Exploit, Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2020/Feb/31 Mailing List, Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2021/Jan/3 Mailing List, Third Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/202003-57 Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20200221-0002/ Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/4279-1/ Patch, Third Party Advisory
  • www.debian.org https://www.debian.org/security/2020/dsa-4626 Third Party Advisory
  • www.debian.org https://www.debian.org/security/2020/dsa-4628 Third Party Advisory
  • www.oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
  • www.oracle.com https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory
  • www.tenable.com https://www.tenable.com/security/tns-2021-14 Patch, Third Party Advisory
  • nvd.nist.gov Official NVD record