Description

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

Remediation

References

CVE-2020-7064

Related Vulnerabilities

WebLogic Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2019-17195)

WordPress Plugin Bulk Delete Users by Email Cross-Site Request Forgery (1.0)

OpenSSL Cryptographic Issues Vulnerability (CVE-2006-4339)

MySQL CVE-2022-39402 Vulnerability (CVE-2022-39402)

PostgreSQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-10915)

Severity

Medium

Classification

CVE-2020-7064 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Tags

Missing Update Known Vulnerabilities