Your submission was sent successfully! Close

CVE-2020-7062

Published: 27 February 2020

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.

Priority

Low

CVSS 3 base score: 7.5

Status

Package Release Status
php5
Launchpad, Ubuntu, Debian
bionic Does not exist

eoan Does not exist

precise Not vulnerable

trusty
Released (5.5.9+dfsg-1ubuntu4.29+esm11)
upstream Needs triage

xenial Does not exist

Patches:
upstream: https://github.com/microsoft/php-src/commit/a8b5510a30a5e8761e841c799a472c6f25560698#diff-52eb9eb7f9d5d9125fbb1337a6541c06
php7.0
Launchpad, Ubuntu, Debian
bionic Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial
Released (7.0.33-0ubuntu0.16.04.14)
php7.2
Launchpad, Ubuntu, Debian
bionic
Released (7.2.24-0ubuntu0.18.04.4)
eoan Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

php7.3
Launchpad, Ubuntu, Debian
bionic Does not exist

eoan
Released (7.3.11-0ubuntu0.19.10.4)
precise Does not exist

trusty Does not exist

upstream
Released (7.3.15-1)
xenial Does not exist

php7.4
Launchpad, Ubuntu, Debian
bionic Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (7.4.3-1)
xenial Does not exist