Description

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

Remediation

References

CVE-2020-7064

Related Vulnerabilities

MODX Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2017-7324)

Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-28378)

WordPress Plugin AVH Extended Categories Widgets SQL Injection (4.0.0)

GibbonEdu Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-45881)

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-6113)

Severity

Medium

Classification

CVE-2020-7064 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Tags

Missing Update Known Vulnerabilities