CVE-2020-7060: Debian Linux

Critical severity, CVSS 9.1. EPSS: 8.9% chance of exploitation in the next 30 days.

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

Affected products

• Debian Debian Linux: version 8.0 only
• Opensuse Leap: version 15.1 only
• Oracle Communications Diameter Signaling Router: from 8.0, up to and including 8.4
• PHP PHP: from 7.2.0, before 7.2.27 (fixed in 7.2.27); from 7.3.0, before 7.3.14 (fixed in 7.3.14); from 7.4.0, before 7.4.2 (fixed in 7.4.2)
• Tenable Tenable.sc: before 5.19.0 (fixed in 5.19.0)

Published 2020-02-10. Last modified 2026-06-17.