5.8
CVE-2020-7064
- EPSS 4.3%
- Veröffentlicht 01.04.2020 04:15:13
- Zuletzt bearbeitet 21.11.2024 05:36:36
- Erkennungen
LoginUse-of-uninitialized-value in exif
In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 19.10
Canonical ≫ Ubuntu Linux Version 20.04 SwEdition lts
Tenable ≫ Tenable.Sc Version < 5.19.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 4.3% | 0.899 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.4 | 2.8 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
|
| NIST | 5.8 | 8.6 | 4.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:P
|
| PHP | 6.5 | 3.9 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
|
CWE-125 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.tenable.com/security/tns-2021-14
https://usn.ubuntu.com/4330-1/
https://www.debian.org/security/2020/dsa-4717
https://www.debian.org/security/2020/dsa-4719
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.html
https://bugs.php.net/bug.php?id=79282
https://lists.debian.org/debian-lts-announce/2020/04/msg00021.html
https://security.netapp.com/advisory/ntap-20200403-0001/
https://usn.ubuntu.com/4330-2/