CVE-2020-7065

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.

Score
CVSS 3.1 8.8 High
Status
Modified - security@php.net
Published
2020-04-01
Last modified
2024-09-17
Weaknesses
CWE-121, CWE-787

Affected products

References

 
 
© AVABIS GmbH privacypolicy about