CVE-2020-7060: 
PHP vulnerability analysis and mitigation

CVE-2020-7060 is a security vulnerability discovered in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2. The vulnerability was disclosed on February 10, 2020, and affects the mbstring functions when converting multibyte encodings (CVE-MITRE, PHP-BUG).

The vulnerability occurs in the mbfl_filt_conv_big5_wchar function when processing certain mbstring functions to convert multibyte encodings. When supplied with specific data, the function can read past the allocated buffer, leading to a global buffer overflow condition. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L (NETAPP).

A successful exploitation of this vulnerability could lead to information disclosure or cause the application to crash. The buffer overflow condition could potentially expose sensitive information from memory or result in a denial of service situation (RAPID7).

The vulnerability is remotely exploitable without authentication, meaning it can be exploited over a network without requiring user credentials. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit (NETAPP).

The vulnerability has been fixed in PHP versions 7.2.27, 7.3.14, and 7.4.2. Users are strongly recommended to upgrade to these or later versions. Multiple Linux distributions have also released security updates to address this vulnerability, including Debian, Ubuntu, and Gentoo (DEBIAN, UBUNTU, GENTOO).