Bug 706168 – <dev-lang/php-{7.2.27,7.3.14,7.4.2}: multiple vulnerabilities (CVE-2020-{7059,7060})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2020-01-23 16:16:54 UTC]

CVE-2020-7060 (https://nvd.nist.gov/vuln/detail/CVE-2020-7060):
  ** RESERVED ** This candidate has been reserved by an organization or
  individual that will use it when announcing a new security problem. When the
  candidate has been publicized, the details for this candidate will be
  provided.

CVE-2020-7059 (https://nvd.nist.gov/vuln/detail/CVE-2020-7059):
  ** RESERVED ** This candidate has been reserved by an organization or
  individual that will use it when announcing a new security problem. When the
  candidate has been publicized, the details for this candidate will be
  provided.


Fixed bug https://bugs.php.net/79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059)

Fixed bug https://bugs.php.net/79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). (CVE-2020-7060)

[Comment 1 Agostino Sarubbo 2020-01-24 15:57:42 UTC]

amd64 stable

[Comment 2 Rolf Eike Beer 2020-01-25 17:53:13 UTC]

sparc stable

[Comment 3 Thomas Deutschmann (RETIRED) 2020-01-26 20:25:39 UTC]

x86 stable

[Comment 4 Sergei Trofimovich (RETIRED) 2020-01-27 10:34:12 UTC]

ia64/ppc/ppc64 stable

[Comment 5 Mikle Kolyada (RETIRED) 2020-01-27 11:10:32 UTC]

arm stable

[Comment 6 Rolf Eike Beer 2020-01-28 20:00:36 UTC]

hppa stable

[Comment 7 Mart Raudsepp 2020-03-17 20:49:55 UTC]

Newer stable on arm64 via 710304

[Comment 8 Thomas Deutschmann (RETIRED) 2020-03-26 13:13:21 UTC]

Added to an existing GLSA request.

[Comment 9 GLSAMaker/CVETool Bot 2020-03-26 13:33:08 UTC]

This issue was resolved and addressed in
 GLSA 202003-57 at https://security.gentoo.org/glsa/202003-57
by GLSA coordinator Thomas Deutschmann (whissi).