{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2020-018.pdf"
    },
    "title": "Serious PHP Vulnerability",
    "serial_number": "2020-018",
    "publish_date": "03-04-2020 12:31:00",
    "description": "In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using \"mb_strtolower()\" function with \"UTF-32LE\" encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes, and potentially code execution. No exploits have been observed for the moment.",
    "url_title": "2020-018",
    "content_markdown": "---\ntitle: 'Serious PHP Vulnerability'\nversion: '1.0'\nnumber: '2020-018'\ndate: 'April 03, 2020'\n---\n\n_History:_\n\n* _03/04/2020 --- v1.0 -- Initial publication_\n\n# Summary\n\nIn PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using `mb_strtolower()` function with `UTF-32LE` encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes, and potentially code execution [1]. No exploits have been observed for the moment.\n\n# Technical Details\n\nA call to `mb_strtolower()` allows overwriting of a stack-allocated buffer with an overflown array from `.rodata` (the read-only data segment in memory). It seems that size is well-controlled by an attacker in the range 512-1020, while the data to overwrite with are much less controlled [2].\n\n# Products Affected\n\n The vulnerability was coded as CVE-2020-7065 and it affects PHP versions 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 7.3.10, 7.3.11, 7.3.12, 7.3.13, 7.3.14, 7.4.0, 7.4.1, 7.4.2 [3]\n\n# Recommendations\n\nPHP has released a patch for this vulnerability [4]. It is strongly advised to update to the version  7.4.4 to fix this vulnerability as soon as possible.\n\n# References\n\n[1] <https://www.suse.com/security/cve/CVE-2020-7065/>\n\n[2] <https://bugs.php.net/bug.php?id=79371&edit=3>\n\n[3] <https://vulmon.com/vulnerabilitydetails?qid=CVE-2020-7065>\n\n[4] <https://www.php.net/ChangeLog-7.php#7.4.4l>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>03/04/2020 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using <code>mb_strtolower()</code> function with <code>UTF-32LE</code> encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes, and potentially code execution [1]. No exploits have been observed for the moment.</p><h2 id=\"technical-details\">Technical Details</h2><p>A call to <code>mb_strtolower()</code> allows overwriting of a stack-allocated buffer with an overflown array from <code>.rodata</code> (the read-only data segment in memory). It seems that size is well-controlled by an attacker in the range 512-1020, while the data to overwrite with are much less controlled [2].</p><h2 id=\"products-affected\">Products Affected</h2><p>The vulnerability was coded as CVE-2020-7065 and it affects PHP versions 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 7.3.10, 7.3.11, 7.3.12, 7.3.13, 7.3.14, 7.4.0, 7.4.1, 7.4.2 [3]</p><h2 id=\"recommendations\">Recommendations</h2><p>PHP has released a patch for this vulnerability [4]. It is strongly advised to update to the version 7.4.4 to fix this vulnerability as soon as possible.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.suse.com/security/cve/CVE-2020-7065/\">https://www.suse.com/security/cve/CVE-2020-7065/</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://bugs.php.net/bug.php?id=79371&edit=3\">https://bugs.php.net/bug.php?id=79371&amp;edit=3</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://vulmon.com/vulnerabilitydetails?qid=CVE-2020-7065\">https://vulmon.com/vulnerabilitydetails?qid=CVE-2020-7065</a></p><p>[4] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.php.net/ChangeLog-7.php#7.4.4l\">https://www.php.net/ChangeLog-7.php#7.4.4l</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}