In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade php72Upgrade php73Upgrade php73 | Feb 8, 2020 | Dec 23, 2019 |
| Debian | — | Upgrade php7.3 | Jan 2, 2020 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-cliUpgrade php-fpmUpgrade php-ldapUpgrade php-odbcUpgrade php-pdoUpgrade php-xmlUpgrade php-recodeUpgrade php-commonUpgrade php-gdUpgrade php-xmlrpcUpgrade phpUpgrade php-soapUpgrade php-process | Feb 26, 2020 | Dec 23, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.14-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Dec 23, 2019 |
| Php | — | Upgrade to PHP version 7.3.13Upgrade to PHP version 7.2.26 | Jan 29, 2020 | Dec 23, 2019 |
| Suse | — | Upgrade php72-xmlrpcUpgrade php53-gmpUpgrade php7-iconvUpgrade php72-imapUpgrade php53-shmopUpgrade php72-bcmathUpgrade php7-soapUpgrade php72-xmlwriterUpgrade php53-pdoUpgrade php72-gettextUpgrade php5-xmlreaderUpgrade php5-pcntlUpgrade php5-ctypeUpgrade php7-pdoUpgrade php53-curlUpgrade php7-intlUpgrade php5-wddxUpgrade php7-imapUpgrade php5-domUpgrade php7-pear-archive_tarUpgrade php72-ftpUpgrade php53-sysvmsgUpgrade php53-soapUpgrade php7-bz2Upgrade php7-xslUpgrade php72-readlineUpgrade php53-mbstringUpgrade php7-sqliteUpgrade php72-pspellUpgrade php72-odbcUpgrade php5-iconvUpgrade php53-wddxUpgrade php7-jsonUpgrade php72-snmpUpgrade php72-sysvsemUpgrade php7-zlibUpgrade php53-xmlreaderUpgrade php7-enchantUpgrade php5-gettextUpgrade php7Upgrade php7-ftpUpgrade php7-socketsUpgrade php53-zipUpgrade php5-develUpgrade php72-gmpUpgrade php5-opensslUpgrade php53-mysqlUpgrade php5-mcryptUpgrade php53Upgrade php72-soapUpgrade php7-domUpgrade php5Upgrade php7-xmlwriterUpgrade php53-iconvUpgrade php5-sysvsemUpgrade php7-gmpUpgrade php7-gettextUpgrade php5-mysqlUpgrade apache2-mod_php7Upgrade php72-socketsUpgrade php72-exifUpgrade php5-zipUpgrade php53-bcmathUpgrade php5-xmlrpcUpgrade php53-suhosinUpgrade php5-ftpUpgrade php72-ctypeUpgrade php7-gdUpgrade php72-shmopUpgrade php72-sodiumUpgrade php5-pharUpgrade php53-bz2Upgrade php5-xmlwriterUpgrade php7-sysvmsgUpgrade php7-snmpUpgrade php7-mbstringUpgrade php5-exifUpgrade php7-exifUpgrade php7-posixUpgrade php53-pgsqlUpgrade php5-mbstringUpgrade php72-opcacheUpgrade php5-bcmathUpgrade php53-calendarUpgrade php53-gettextUpgrade php7-pharUpgrade php5-imapUpgrade php7-bcmathUpgrade apache2-mod_php5Upgrade php7-tidyUpgrade php53-sysvsemUpgrade php5-fastcgiUpgrade php72-zlibUpgrade php7-curlUpgrade php72-mysqlUpgrade php5-opcacheUpgrade php53-ldapUpgrade php7-fpmUpgrade php7-embedUpgrade php72-xmlreaderUpgrade php53-ftpUpgrade php5-jsonUpgrade php53-odbcUpgrade php53-gdUpgrade php72-iconvUpgrade php7-pgsqlUpgrade php7-xmlreaderUpgrade php72-pgsqlUpgrade php72-fpmUpgrade php72-sqliteUpgrade php72-curlUpgrade php7-wddxUpgrade php5-gmpUpgrade php72-tidyUpgrade php7-tokenizerUpgrade php5-socketsUpgrade php5-pdoUpgrade php72-fastcgiUpgrade php72Upgrade php5-xslUpgrade php7-pearUpgrade php53-pcntlUpgrade php7-opcacheUpgrade php5-fpmUpgrade php5-pgsqlUpgrade php72-wddxUpgrade php7-zipUpgrade php72-bz2Upgrade php7-calendarUpgrade php53-ctypeUpgrade php5-tokenizerUpgrade php53-snmpUpgrade php53-tokenizerUpgrade php7-sysvsemUpgrade php53-domUpgrade php7-testUpgrade php7-dbaUpgrade php72-dbaUpgrade php72-pcntlUpgrade php53-pspellUpgrade php5-fileinfoUpgrade php72-pharUpgrade php72-posixUpgrade apache2-mod_php53Upgrade php5-intlUpgrade php72-opensslUpgrade php5-odbcUpgrade php7-fastcgiUpgrade php7-pcntlUpgrade php7-ctypeUpgrade php53-opensslUpgrade php5-bz2Upgrade php72-xslUpgrade php53-intlUpgrade php53-fastcgiUpgrade php53-fileinfoUpgrade php5-dbaUpgrade php72-tokenizerUpgrade php5-enchantUpgrade php53-dbaUpgrade php53-jsonUpgrade php5-suhosinUpgrade php53-mcryptUpgrade php7-readlineUpgrade php53-sysvshmUpgrade apache2-mod_php72Upgrade php7-sysvshmUpgrade php72-calendarUpgrade php5-curlUpgrade php53-zlibUpgrade php7-firebirdUpgrade php5-gdUpgrade php53-xslUpgrade php7-mcryptUpgrade php7-sodiumUpgrade php7-develUpgrade php72-pear-archive_tarUpgrade php5-posixUpgrade php72-jsonUpgrade php5-sysvmsgUpgrade php72-zipUpgrade php72-develUpgrade php7-fileinfoUpgrade php5-calendarUpgrade php7-xmlrpcUpgrade php53-xmlrpcUpgrade php53-exifUpgrade php7-odbcUpgrade php72-enchantUpgrade php72-pearUpgrade php72-sysvmsgUpgrade php5-sysvshmUpgrade php5-snmpUpgrade php53-pearUpgrade php7-shmopUpgrade php7-pspellUpgrade php72-fileinfoUpgrade php5-zlibUpgrade php53-xmlwriterUpgrade php5-pspellUpgrade php5-ldapUpgrade php72-intlUpgrade php7-opensslUpgrade php72-ldapUpgrade php5-pearUpgrade php7-ldapUpgrade php72-pdoUpgrade php5-soapUpgrade php7-mysqlUpgrade php5-shmopUpgrade php72-mbstringUpgrade php72-domUpgrade php72-sysvshmUpgrade php5-sqliteUpgrade php72-gd | Jan 22, 2020 | Dec 23, 2019 |
| Ubuntu | — | Upgrade php5-xmlrpc (Ubuntu Pro)Upgrade php7.3-xmlrpcUpgrade php5-fpm (Ubuntu Pro)Upgrade php7.2-mbstringUpgrade libapache2-mod-php7.3Upgrade php7.0-mbstringUpgrade php7.3-fpmUpgrade php5-cli (Ubuntu Pro)Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php7.0-xmlrpcUpgrade php7.2-cliUpgrade php7.2-xmlrpcUpgrade libapache2-mod-php7.2Upgrade php7.3-bcmathUpgrade php7.2-cgiUpgrade php7.3-cgiUpgrade php5-fpmUpgrade php7.2-bcmathUpgrade php7.3-cliUpgrade php5-cliUpgrade php7.0-fpmUpgrade php7.0-cgiUpgrade php7.2-fpmUpgrade php7.3-mbstringUpgrade php7.0-cliUpgrade libapache2-mod-php7.0Upgrade php5-cgiUpgrade php7.0-bcmathUpgrade libapache2-mod-php5Upgrade php5-xmlrpcUpgrade php5-cgi (Ubuntu Pro) | Jan 16, 2020 | Dec 23, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub