| Package | Affected versions | Patched versions |
|---|---|---|
| php | ≥ 7.3.0, < 7.3.16≥ 7.4.0, < 7.4.4 | 7.3.167.4.4 |
| tenable.sc | < 5.19.0 | 5.19.0 |
In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free