NetSight
IP …
high7.5

CVE-2020-7062

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but…

Impact

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.

Affected products

VendorProductAffected versions
PhpPhp
from 7.2.0 through 7.2.27
from 7.3.0 through 7.3.14
from 7.4.0 through 7.4.2
OpensuseLeap
Version 15.1
DebianDebian Linux
Versions 8.0, 9.0, 10.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 19.10

Weakness classification

CWE-476

References