CVE-2020-7064: Use-of-uninitialized-value in exif
A vulnerability was found in PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exifreaddata() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.
Other sources
Fixed bug (Use-of-uninitialized-value in exif) (CVE-2020-7064) (Nikita)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php73-phpto a version that resolves this vulnerability.Fixed in 0:7.3.20-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.9 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.3.16 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.4.4 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.29 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.9 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.3.16 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.4.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-7064?
CVE-2020-7064 is a vulnerability in PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16, and 7.4.x below 7.4.4 that allows malicious data to cause PHP to read uninitialized memory, potentially leading to information disclosure or a crash.
How does CVE-2020-7064 affect PHP?
CVE-2020-7064 affects PHP by allowing malicious data to be parsed with the exif_read_data() function, leading to the potential reading of uninitialized memory.
What is the severity of CVE-2020-7064?
The severity of CVE-2020-7064 is medium with a severity score of 5.4.
How can I fix CVE-2020-7064?
Fix CVE-2020-7064 by upgrading PHP to version 7.2.9 or above for PHP 7.2.x, version 7.3.16 or above for PHP 7.3.x, and version 7.4.4 or above for PHP 7.4.x.
Where can I find more information about CVE-2020-7064?
More information about CVE-2020-7064 can be found at the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1820602), [PHP Bugs](https://bugs.php.net/bug.php?id=79282), [PHP Git Commit](http://git.php.net/?p=php-src.git;a=commit;h=0c77b4307df73217283a4aaf9313e1a33a0967ff).