NetSight
IP …
low3.7

CVE-2019-11044

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as ter…

Impact

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Affected products

VendorProductAffected versions
PhpPhp
from 7.2.0 through 7.2.26
from 7.3.0 through 7.3.13
Version 7.4.0
TenableSecurity Center
before 5.19.0
FedoraprojectFedora
Versions 30, 31

Weakness classification

CWE-170

References