CVE-2020-7064

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-7064
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-7064.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-7064
Aliases
Downstream
Related
Published
2020-04-01T04:15:13.693Z
Modified
2026-07-07T08:50:47.179314993Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVSS Calculator
Summary
[none]
Details

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exifreaddata() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_RANGE",
            "cpes": [
                "cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "fixed": "5.19.0"
                }
            ],
            "vendor_product": "tenable:tenable.sc"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "12.04"
                },
                {
                    "last_affected": "12.04"
                },
                {
                    "introduced": "14.04"
                },
                {
                    "last_affected": "14.04"
                },
                {
                    "introduced": "16.04"
                },
                {
                    "last_affected": "16.04"
                },
                {
                    "introduced": "18.04"
                },
                {
                    "last_affected": "18.04"
                },
                {
                    "introduced": "19.10"
                },
                {
                    "last_affected": "19.10"
                },
                {
                    "introduced": "20.04"
                },
                {
                    "last_affected": "20.04"
                }
            ],
            "vendor_product": "canonical:ubuntu_linux"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                }
            ],
            "vendor_product": "debian:debian_linux"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "15.1"
                },
                {
                    "last_affected": "15.1"
                }
            ],
            "vendor_product": "opensuse:leap"
        }
    ]
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
8148cbb78841c8ec0759c0836e7f35dec799d300
Fixed
cc274342d26942fc162aff6203e23372b5715d80
Introduced
52ace952a1b65ca80fc2617f11c2fa6dd03f51bd
Fixed
4e330d3d488c232ad5f9769f1fa9471c9b5ad088
Introduced
3c7824e16ec4c3cee417262445d2c2b66531c10f
Fixed
acfdeccb2ee5821138a8d68b12177daff1e63e41
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "7.2.0"
        },
        {
            "fixed": "7.2.29"
        },
        {
            "introduced": "7.3.0"
        },
        {
            "fixed": "7.3.16"
        },
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.4"
        }
    ],
    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-7064.json"