WaratekVRT Sign in

CVE-2020-7060 PHP

Affected softwarePHP
Severity9.1 Critical CVSS 3.1 3 scores
WeaknessOut-of-bounds read (CWE-125)
Published10 Feb 2020
Updated17 Jun 2026

Description

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 8.9% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.1 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H NVD Primary published
CVSS 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L security@php.net Secondary
CVSS 2.0 6.4 none AV:N/AC:L/Au:N/C:P/I:N/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Communications Applications / Platform (PHP) (8.0-8.4)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications Platform (PHP) 8.0-8.4

Products and versions

5 products, 7 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 8.0
nvd opensuse leap generic 15.1
nvd oracle communications diameter signaling router generic ≥ 8.0 and ≤ 8.4
nvd php php generic ≥ 7.2.0 and ＜ 7.2.27 · ≥ 7.3.0 and ＜ 7.3.14 · ≥ 7.4.0 and ＜ 7.4.2
nvd tenable tenable.sc generic ＜ 5.19.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, PLATFORM (PHP), NO AUTH REMOTE EXPLOIT **Products:** ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER (DSR), ORACLE COMMUNICATIONS APPLICATIONS, PHP

References

URLTags
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html Mailing List, Third Party Advisory
https://bugs.php.net/bug.php?id=79037 Exploit, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Feb/31 Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2021/Jan/3 Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202003-57 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200221-0002/ Mailing List, Third Party Advisory
https://usn.ubuntu.com/4279-1/ Patch, Third Party Advisory
https://www.debian.org/security/2020/dsa-4626 Third Party Advisory

Timeline
Published2020-02-10By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.