CVE-2020-7064
Use-of-uninitialized-value in exif
En bref Sévérité MEDIUM 6.5 EPSS EPSS 4.29 % · centile 91 (2026-10-27) État PUBLISHED Publiée 2020-04-01 Mise à jour 2024-09-16 Attribuée par php Statut NVD Modified Description In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L php CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L NVD · security@php.net (Secondary) CVSS 3.1 MEDIUM 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.29cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.3.0 < 7.3.16cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.4cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* < 5.19.0Produits affectés Produit Versions PHP Group · PHP affected 7.3.x < 7.3.16 ; affected 7.4.x < 7.4.4 ; affected 7.2.x < 7.2.29
Références
Sources
