PRIOn knowledge basePRION:CVE-2020-7059Information disclosure
When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.
References
lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html
bugs.php.net/bug.php?id=79099
lists.debian.org/debian-lts-announce/2020/02/msg00030.html
seclists.org/bugtraq/2020/Feb/27
seclists.org/bugtraq/2020/Feb/31
seclists.org/bugtraq/2021/Jan/3
security.gentoo.org/glsa/202003-57
security.netapp.com/advisory/ntap-20200221-0002/
usn.ubuntu.com/4279-1/
www.debian.org/security/2020/dsa-4626
www.debian.org/security/2020/dsa-4628
www.oracle.com/security-alerts/cpuApr2021.html
www.oracle.com/security-alerts/cpujul2020.html
www.tenable.com/security/tns-2021-14
Related
