title: OOB read in php_strip_tags_ex
description: When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.
problem types: CWE-125 Out-of-bounds Read
affected:
{
product: PHP
vendor: PHP Group
versions:
lessThan: 7.2.27, status: affected, version: 7.2.x, versionType: custom
lessThan: 7.3.14, status: affected, version: 7.3.x, versionType: custom
lessThan: 7.4.2, status: affected, version: 7.4.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
]
workarounds: Usage of fgetss() has been DEPRECATED as of PHP 7.3.0. Please use strip_tags() or other means sanitizing HTML code.