CVE-2019-11044: link() silently truncates after a null byte on Windows
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Other sources
Fixed bug (link() silently truncates after a null byte on Windows). (CVE-2019-11044)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.26 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.2.26 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.3.13 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.4.0
Event History
Frequently Asked Questions
What is CVE-2019-11044?
CVE-2019-11044 is a vulnerability in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, where the link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte, potentially leading to security vulnerabilities.
How severe is CVE-2019-11044?
The severity of CVE-2019-11044 is high with a severity value of 7.5.
How can I fix CVE-2019-11044?
To fix CVE-2019-11044, upgrade PHP to version 7.2.26 or above, 7.3.13 or above, or 7.4.0 or above depending on the affected version.
What are some references for CVE-2019-11044?
You can find more information about CVE-2019-11044 at these references: [Reference 1](https://www.php.net/ChangeLog-7.php#7.2.26), [Reference 2](https://bugs.php.net/bug.php?id=78862), [Reference 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/).
What is the CWE of CVE-2019-11044?
The CWE of CVE-2019-11044 is CWE-170.