title: global buffer-overflow in mbfl_filt_conv_big5_wchar
description: When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
problem types: CWE-125 Out-of-bounds Read
affected:
{
product: PHP
vendor: PHP Group
versions:
lessThan: 7.2.27, status: affected, version: 7.2.x, versionType: custom
lessThan: 7.3.14, status: affected, version: 7.3.x, versionType: custom
lessThan: 7.4.2, status: affected, version: 7.4.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
]