CVE-2020-7064 — Out-of-bounds Read in Group PHP

CWE-125 — Out-of-bounds ReadCWE-200 — Sensitive Information Exposure12 documents8 sources
Severity
5.4MEDIUMNVD
CNA6.5
EPSS
2.3%
top 15.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
PHP Group PHPPHPTenable Tenable.sc+3 more
Timeline
PublishedApr 1
Latest updateMay 24

Description

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:LExploitability: 2.8 | Impact: 2.5

Affected Packages4 packages

▶NVDphp/php7.2.0 — 7.2.29+2
▶CVEListV5php_group/php7.3.x — 7.3.16+2
▶NVDtenable/tenable.sc< 5.19.0
▶NVDopensuse/leap15.1

Also affects: Debian Linux 10.0, 8.0, 9.0, Ubuntu Linux 12.04, 14.04, 16.04, 18.04, 19.10, 20.04

Patches

Patch: bugs.php.net ↗Patch: www.tenable.com ↗Patch: bugs.php.net ↗

🔴Vulnerability Details

5
GHSA
GHSA-rw73-mxr4-6595: In PHP versions 7↗2022-05-24
▶
OSV
php7.4 vulnerabilities↗2020-05-06
▶
OSV
php5, php7.0, php7.2, php7.3 vulnerabilities↗2020-04-15
▶
CVEList
Use-of-uninitialized-value in exif↗2020-04-01
▶
OSV
CVE-2020-7064: In PHP versions 7↗2020-04-01
▶

📋Vendor Advisories

4
Ubuntu
PHP vulnerabilities↗2020-05-06
▶
Ubuntu
PHP vulnerabilities↗2020-04-15
▶
Red Hat
php: Information disclosure in exif_read_data() function↗2020-04-01
▶
Debian
CVE-2020-7064: php7.4 - In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, whi...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-7064 php: Information disclosure in exif_read_data() function↗2020-04-03
▶
Bugzilla
CVE-2020-7064 php: information disclosure in exif_read_data() function [fedora-all]↗2020-04-03
▶
CVE-2020-7064 — Out-of-bounds Read in PHP Group PHP | cvebase