CVE-2020-7059: Debian Linux

Critical severity, CVSS 9.1. EPSS: 7.4% chance of exploitation in the next 30 days.

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

Affected products

• Debian Debian Linux: version 8.0 only
• Opensuse Leap: version 15.1 only
• Oracle Communications Diameter Signaling Router: from 8.0, up to and including 8.4
• PHP PHP: from 7.2.0, before 7.2.27 (fixed in 7.2.27); from 7.3.0, before 7.3.14 (fixed in 7.3.14); from 7.4.0, before 7.4.2 (fixed in 7.4.2)
• Tenable Tenable.sc: before 5.19.0 (fixed in 5.19.0)

Published 2020-02-10. Last modified 2026-06-17.