CVE-2020-7064

Description

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

Weakness classification

• security@php.net: CWE-125
• nvd@nist.gov: CWE-125

Primary references

• security@php.net — Mailing List, Third Party Advisory
• security@php.net — Exploit, Issue Tracking, Patch, Vendor Advisory
• security@php.net — Mailing List, Third Party Advisory
• security@php.net — Third Party Advisory
• security@php.net — Third Party Advisory
• security@php.net — Third Party Advisory
• security@php.net — Third Party Advisory
• security@php.net — Third Party Advisory
• security@php.net — Third Party Advisory
• security@php.net — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Patch, Vendor Advisory