CVE-2020-7060
global buffer-overflow in mbfl_filt_conv_big5_wchar
When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
We have discovered 585,899 live websites that are affected by CVE-2020-7060.
Affected Software
| Product |  PHP |
| Category | Programming Languages |
| Vulnerable Versions |
|
| Total Vulnerable Versions | 507 |
| Vulnerable Domains | 585,899 live websites (4.84% of PHP install base) |
Distribution by Website Rank
The diagram provides a graphic representation of the correlation between the occurrence of CVE-2020-7060 and the relative popularity of websitesDetails
- Published - Jan 21, 2020
- Updated - Jul 23, 2021
Credits
- Reported by reza at iseclab dot org
CWE
CVE References
CWE References
Countries
 United States | 112,886 websites |
 France | 242,525 websites |
 Russia | 65,060 websites |
 China | 19,522 websites |
 Poland | 12,529 websites |
 Germany | 12,128 websites |
 Belgium | 11,454 websites |
 Italy | 11,403 websites |
 Spain | 9,050 websites |
 GB | 8,829 websites |
TLDs
| .com | 238,585 websites |
| .fr | 108,619 websites |
| .ru | 63,055 websites |
| .org | 23,181 websites |
| .net | 15,307 websites |
| .be | 12,852 websites |
| .pl | 9,863 websites |
| .it | 8,585 websites |
| .de | 7,349 websites |
| .nl | 6,413 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redGeographical Distribution
The distribution of websites across the globe that are exposed to CVE-2020-7060 through included software libraries and plugins.References
- https://seclists.org/bugtraq/2020/Feb/27
- https://www.debian.org/security/2020/dsa-4626
- https://usn.ubuntu.com/4279-1/
- https://www.debian.org/security/2020/dsa-4628
- https://seclists.org/bugtraq/2020/Feb/31
- https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html
- https://security.gentoo.org/glsa/202003-57
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.netapp.com/advisory/ntap-20200221-0002/
- https://bugs.php.net/bug.php?id=79037
- https://seclists.org/bugtraq/2021/Jan/3
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.tenable.com/security/tns-2021-14
Websites affected by CVE-2020-7060
Top websites that are affected by CVE-2020-7060. Please click on the "Contact us" button above to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ***.*****.cz |  Czech Republic | *,*** | |
| *.cn | China | *,*** | |
| ***.*.cn | China | *,*** | |
| *****.***.cn | China | *,*** | |
| ***.*****.***.cn | China | *,*** | |
| *****.cn | China | *,*** | |
| ***.*****.cn | China | *,*** | |
| ***.*********.com | China | *,*** | |
| *.***.cn | China | *,*** | |
| ***.*.***.cn | China | *,*** |