CVE catalog

CVE-2020-7060

UBUNTU-

[CVE catalog]

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
8.89% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Ubuntuprophp55.5.3+dfsg-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.3+dfsg-1ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.6+dfsg-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.6+dfsg-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.8+dfsg-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.11UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.12UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]

Showing 12 observations. All 94 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debian11php7.47.4.2-7UnknownSource applicability is not established[DEBIAN-CVE-2020-7060]
Ubuntu16.04php7.07.0.1-5UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.1-6UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.13-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.15-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.15-0ubuntu0.16.04.2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.15-0ubuntu0.16.04.4UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.18-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.2-1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.2-3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.2-4UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.2-5UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.22-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.25-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.28-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.3-2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.3-3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.3-9ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.30-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.32-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.33-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.33-0ubuntu0.16.04.11UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.33-0ubuntu0.16.04.2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.33-0ubuntu0.16.04.3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.33-0ubuntu0.16.04.4UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.33-0ubuntu0.16.04.5UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.33-0ubuntu0.16.04.6UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.33-0ubuntu0.16.04.7UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.33-0ubuntu0.16.04.9UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.4-5ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.4-5ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.4-7ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.4-7ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.4-7ubuntu2.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.8-0ubuntu0.16.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.8-0ubuntu0.16.04.2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu16.04php7.07.0.8-0ubuntu0.16.04.3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.1-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.10-0ubuntu0.18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.15-0ubuntu0.18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.15-0ubuntu0.18.04.2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.17-0ubuntu0.18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.19-0ubuntu0.18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.19-0ubuntu0.18.04.2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.2-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.2-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.24-0ubuntu0.18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.24-0ubuntu0.18.04.2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.24-0ubuntu0.18.04.3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.3-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.5-0ubuntu0.18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.7-0ubuntu0.18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntu18.04php7.27.2.7-0ubuntu0.18.04.2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.3+dfsg-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.3+dfsg-1ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.6+dfsg-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.6+dfsg-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.8+dfsg-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.11UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.12UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.13UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.14UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.16UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.17UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.19UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.20UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.21UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.22UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.23UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.24UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.25UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.26UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.27UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.29UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.29+esm1UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.29+esm10UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.29+esm2UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.29+esm3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.29+esm4UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.29+esm5UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.29+esm6UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.29+esm8UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.3UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.4UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.5UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.6UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.7UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Ubuntuprophp55.5.9+dfsg-1ubuntu4.9UnknownSource applicability is not established[UBUNTU-CVE-2020-7060]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "php7.4",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.4.2-7"
            }
          ]
        }
      ],
      "release": "11",
      "versions": [],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-7060",
      "fixed_version": "7.4.2-7",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2020-7060",
      "provider_updated_at": "2026-08-27T13:03:15.801625617Z",
      "applicability_unknown": true
    },
    {
      "name": "php5",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.9+dfsg-1ubuntu4.29+esm10"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "5.5.3+dfsg-1ubuntu2",
        "5.5.3+dfsg-1ubuntu3",
        "5.5.6+dfsg-1ubuntu1",
        "5.5.6+dfsg-1ubuntu2",
        "5.5.8+dfsg-2ubuntu1",
        "5.5.9+dfsg-1ubuntu1",
        "5.5.9+dfsg-1ubuntu2",
        "5.5.9+dfsg-1ubuntu3",
        "5.5.9+dfsg-1ubuntu4",
        "5.5.9+dfsg-1ubuntu4.1",
        "5.5.9+dfsg-1ubuntu4.2",
        "5.5.9+dfsg-1ubuntu4.3",
        "5.5.9+dfsg-1ubuntu4.4",
        "5.5.9+dfsg-1ubuntu4.5",
        "5.5.9+dfsg-1ubuntu4.6",
        "5.5.9+dfsg-1ubuntu4.7",
        "5.5.9+dfsg-1ubuntu4.9",
        "5.5.9+dfsg-1ubuntu4.11",
        "5.5.9+dfsg-1ubuntu4.12",
        "5.5.9+dfsg-1ubuntu4.13",
        "5.5.9+dfsg-1ubuntu4.14",
        "5.5.9+dfsg-1ubuntu4.16",
        "5.5.9+dfsg-1ubuntu4.17",
        "5.5.9+dfsg-1ubuntu4.19",
        "5.5.9+dfsg-1ubuntu4.20",
        "5.5.9+dfsg-1ubuntu4.21",
        "5.5.9+dfsg-1ubuntu4.22",
        "5.5.9+dfsg-1ubuntu4.23",
        "5.5.9+dfsg-1ubuntu4.24",
        "5.5.9+dfsg-1ubuntu4.25",
        "5.5.9+dfsg-1ubuntu4.26",
        "5.5.9+dfsg-1ubuntu4.27",
        "5.5.9+dfsg-1ubuntu4.29",
        "5.5.9+dfsg-1ubuntu4.29+esm1",
        "5.5.9+dfsg-1ubuntu4.29+esm2",
        "5.5.9+dfsg-1ubuntu4.29+esm3",
        "5.5.9+dfsg-1ubuntu4.29+esm4",
        "5.5.9+dfsg-1ubuntu4.29+esm5",
        "5.5.9+dfsg-1ubuntu4.29+esm6",
        "5.5.9+dfsg-1ubuntu4.29+esm8"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-7060",
      "fixed_version": "5.5.9+dfsg-1ubuntu4.29+esm10",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-7060",
      "provider_updated_at": "2026-04-22T12:43:01.332237Z",
      "applicability_unknown": true
    },
    {
      "name": "php7.0",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.33-0ubuntu0.16.04.11"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "7.0.1-5",
        "7.0.1-6",
        "7.0.2-1",
        "7.0.2-3",
        "7.0.2-4",
        "7.0.2-5",
        "7.0.3-2",
        "7.0.3-3",
        "7.0.3-9ubuntu1",
        "7.0.4-5ubuntu1",
        "7.0.4-5ubuntu2",
        "7.0.4-7ubuntu1",
        "7.0.4-7ubuntu2",
        "7.0.4-7ubuntu2.1",
        "7.0.8-0ubuntu0.16.04.1",
        "7.0.8-0ubuntu0.16.04.2",
        "7.0.8-0ubuntu0.16.04.3",
        "7.0.13-0ubuntu0.16.04.1",
        "7.0.15-0ubuntu0.16.04.1",
        "7.0.15-0ubuntu0.16.04.2",
        "7.0.15-0ubuntu0.16.04.4",
        "7.0.18-0ubuntu0.16.04.1",
        "7.0.22-0ubuntu0.16.04.1",
        "7.0.25-0ubuntu0.16.04.1",
        "7.0.28-0ubuntu0.16.04.1",
        "7.0.30-0ubuntu0.16.04.1",
        "7.0.32-0ubuntu0.16.04.1",
        "7.0.33-0ubuntu0.16.04.1",
        "7.0.33-0ubuntu0.16.04.2",
        "7.0.33-0ubuntu0.16.04.3",
        "7.0.33-0ubuntu0.16.04.4",
        "7.0.33-0ubuntu0.16.04.5",
        "7.0.33-0ubuntu0.16.04.6",
        "7.0.33-0ubuntu0.16.04.7",
        "7.0.33-0ubuntu0.16.04.9"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-7060",
      "fixed_version": "7.0.33-0ubuntu0.16.04.11",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-7060",
      "provider_updated_at": "2026-04-22T12:43:01.332237Z",
      "applicability_unknown": true
    },
    {
      "name": "php7.2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.24-0ubuntu0.18.04.3"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "7.2.1-1ubuntu2",
        "7.2.2-1ubuntu1",
        "7.2.2-1ubuntu2",
        "7.2.3-1ubuntu1",
        "7.2.5-0ubuntu0.18.04.1",
        "7.2.7-0ubuntu0.18.04.1",
        "7.2.7-0ubuntu0.18.04.2",
        "7.2.10-0ubuntu0.18.04.1",
        "7.2.15-0ubuntu0.18.04.1",
        "7.2.15-0ubuntu0.18.04.2",
        "7.2.17-0ubuntu0.18.04.1",
        "7.2.19-0ubuntu0.18.04.1",
        "7.2.19-0ubuntu0.18.04.2",
        "7.2.24-0ubuntu0.18.04.1",
        "7.2.24-0ubuntu0.18.04.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-7060",
      "fixed_version": "7.2.24-0ubuntu0.18.04.3",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-7060",
      "provider_updated_at": "2026-04-22T12:43:01.332237Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]