Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2020-7065

mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

  • 7.3.x to < 7.3.16affected
  • 7.4.x to < 7.4.4affected

References