PHP up to 7.2.8/7.3.15/7.4.3 EXIF Data exif_read_data out-of-bounds

Summaryinfo

A vulnerability identified as problematic has been detected in PHP up to 7.2.8/7.3.15/7.4.3. Affected by this issue is the function exif_read_data of the component EXIF Data Handler. The manipulation leads to out-of-bounds. This vulnerability is listed as CVE-2020-7064. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in PHP up to 7.2.8/7.3.15/7.4.3 (Programming Language Software) and classified as problematic. This issue affects the function exif_read_data of the component EXIF Data Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality. The summary by CVE is:

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

The weakness was presented 04/01/2020. The identification of this vulnerability is CVE-2020-7064 since 01/15/2020. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 7.2.9, 7.3.16 or 7.4.4 eliminates this vulnerability.

See VDB-152485 and VDB-152484 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Name

• PHP

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.3.0
• 7.3.1
• 7.3.2
• 7.3.3
• 7.3.4
• 7.3.5
• 7.3.6
• 7.3.7
• 7.3.8
• 7.3.9
• 7.3.10
• 7.3.11
• 7.3.12
• 7.3.13
• 7.3.14
• 7.3.15
• 7.4.0
• 7.4.1
• 7.4.2
• 7.4.3

License

• open-source

Website

• Product: https://www.php.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion