In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-rrdUpgrade php-develUpgrade libzip-develUpgrade php-enchantUpgrade php-xmlrpcUpgrade php-cliUpgrade php-gmpUpgrade php-mbstringUpgrade php-processUpgrade php-gdUpgrade php-soapUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-pecl-xdebugUpgrade php-pecl-zipUpgrade libzip-toolsUpgrade php-pearUpgrade php-fpmUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-recodeUpgrade libzipUpgrade php-snmpUpgrade php-dbaUpgrade php-embeddedUpgrade php-xmlUpgrade php-intlUpgrade php-dbgUpgrade php-pgsqlUpgrade php-pecl-apcuUpgrade apcu-panelUpgrade php-ldapUpgrade phpUpgrade php-pdoUpgrade php-commonUpgrade php-bcmathUpgrade php-odbc | May 4, 2022 | Feb 27, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Feb 27, 2020 |
| Amazon_linux | — | Upgrade php73Upgrade php72 | Mar 14, 2020 | Feb 27, 2020 |
| Centos_linux | — | Upgrade php-xmlUpgrade php-mbstring-debuginfoUpgrade php-cliUpgrade libzip-develUpgrade php-intlUpgrade php-intl-debuginfoUpgrade php-soap-debuginfoUpgrade php-dbgUpgrade php-opcacheUpgrade phpUpgrade libzip-toolsUpgrade php-opcache-debuginfoUpgrade php-recodeUpgrade libzip-debuginfoUpgrade php-odbcUpgrade php-snmpUpgrade php-pgsql-debuginfoUpgrade php-recode-debuginfoUpgrade php-mysqlndUpgrade apcu-panelUpgrade php-pecl-rrd-debugsourceUpgrade php-common-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-commonUpgrade php-dba-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-json-debuginfoUpgrade php-mbstringUpgrade php-snmp-debuginfoUpgrade php-dbaUpgrade php-soapUpgrade php-enchant-debuginfoUpgrade php-enchantUpgrade php-embedded-debuginfoUpgrade php-embeddedUpgrade php-process-debuginfoUpgrade libzip-debugsourceUpgrade php-fpm-debuginfoUpgrade php-gd-debuginfoUpgrade libzipUpgrade php-pecl-rrdUpgrade php-gmp-debuginfoUpgrade php-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-pearUpgrade php-odbc-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-pdo-debuginfoUpgrade php-pdoUpgrade php-gmpUpgrade php-pecl-xdebug-debuginfoUpgrade php-bcmathUpgrade php-ldapUpgrade php-dbg-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-pgsqlUpgrade php-fpmUpgrade php-develUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebugUpgrade php-xml-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-gdUpgrade php-pecl-apcuUpgrade php-xmlrpcUpgrade php-process | Sep 9, 2020 | Feb 27, 2020 |
| Debian | — | Upgrade php7.4 | Mar 30, 2020 | Feb 27, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Mar 27, 2020 | Feb 27, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-xmlUpgrade php-cliUpgrade php-pdoUpgrade php-gdUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-processUpgrade php-soapUpgrade php-ldapUpgrade php-commonUpgrade php-pgsqlUpgrade php-odbcUpgrade php | Nov 3, 2020 | Feb 27, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade phpUpgrade php-pgsqlUpgrade php-soapUpgrade php-odbcUpgrade php-gdUpgrade php-commonUpgrade php-ldapUpgrade php-xmlrpcUpgrade php-processUpgrade php-mysqlUpgrade php-recodeUpgrade php-cliUpgrade php-xmlUpgrade php-pdo | Sep 28, 2020 | Feb 27, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-xmlUpgrade phpUpgrade php-commonUpgrade php-cliUpgrade php-recodeUpgrade php-processUpgrade php-gdUpgrade php-odbcUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-soapUpgrade php-fpmUpgrade php-ldap | Jul 31, 2020 | Feb 27, 2020 |
| Oracle Solaris | — | Upgrade web/php-74 to version 7.4.3-11.4.21.0.1.69.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.15-11.4.20.0.1.4.0 on Solaris 11.4 | Jan 19, 2021 | Feb 27, 2020 |
| Oracle_linux | — | Upgrade php-commonUpgrade php-dbgUpgrade php-fpmUpgrade php-embeddedUpgrade php-pgsqlUpgrade php-jsonUpgrade php-snmpUpgrade php-pecl-xdebugUpgrade php-pecl-zipUpgrade php-pecl-apcuUpgrade php-cliUpgrade php-intlUpgrade apcu-panelUpgrade php-pearUpgrade php-odbcUpgrade php-xmlUpgrade libzipUpgrade php-ldapUpgrade php-gmpUpgrade libzip-develUpgrade php-develUpgrade phpUpgrade php-bcmathUpgrade php-pdoUpgrade php-pecl-apcu-develUpgrade php-enchantUpgrade php-recodeUpgrade php-processUpgrade php-soapUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-mbstringUpgrade libzip-toolsUpgrade php-gdUpgrade php-pecl-rrdUpgrade php-dbaUpgrade php-xmlrpc | Sep 10, 2020 | Feb 4, 2020 |
| Php | — | Upgrade to PHP version 7.3.15Upgrade to PHP version 7.2.28Upgrade to PHP version 7.4.3 | Mar 27, 2020 | Feb 27, 2020 |
| Redhat_linux | — | Upgrade php-pecl-rrdUpgrade php-json-debuginfoUpgrade php-gd-debuginfoUpgrade php-xml-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pgsqlUpgrade php-pdo-debuginfoUpgrade php-gdUpgrade php-jsonUpgrade php-enchantUpgrade php-pecl-apcu-debuginfoUpgrade php-soapUpgrade php-bcmathUpgrade php-develUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-gmpUpgrade php-ldapUpgrade php-pecl-apcu-debugsourceUpgrade php-fpm-debuginfoUpgrade php-odbcUpgrade php-dbaUpgrade php-mbstring-debuginfoUpgrade php-snmp-debuginfoUpgrade php-mbstringUpgrade libzip-debuginfoUpgrade php-dba-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-zipUpgrade php-pecl-xdebugUpgrade php-pdoUpgrade libzipUpgrade libzip-tools-debuginfoUpgrade libzip-debugsourceUpgrade php-processUpgrade php-fpmUpgrade php-process-debuginfoUpgrade php-intl-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-apcuUpgrade php-common-debuginfoUpgrade php-debuginfoUpgrade php-recode-debuginfoUpgrade php-snmpUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-recodeUpgrade php-opcacheUpgrade php-dbgUpgrade php-intlUpgrade php-enchant-debuginfoUpgrade php-pgsql-debuginfoNo solution existsUpgrade php-debugsourceUpgrade php-embedded-debuginfoUpgrade php-xmlUpgrade php-opcache-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-ldap-debuginfoUpgrade php-cliUpgrade php-soap-debuginfoUpgrade phpUpgrade php-embeddedUpgrade libzip-toolsUpgrade libzip-develUpgrade php-pearUpgrade php-common | Sep 9, 2020 | Feb 27, 2020 |
| Rocky_linux | — | Upgrade php-xmlrpc-debuginfoUpgrade php-mysqlndUpgrade php-embeddedUpgrade php-pdoUpgrade php-opcacheUpgrade php-recodeUpgrade phpUpgrade libzip-tools-debuginfoUpgrade php-bcmathUpgrade php-pecl-rrdUpgrade php-pgsql-debuginfoUpgrade php-cli-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-dba-debuginfoUpgrade php-debuginfoUpgrade php-process-debuginfoUpgrade php-odbc-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebugUpgrade php-common-debuginfoUpgrade php-xmlrpcUpgrade php-intl-debuginfoUpgrade php-commonUpgrade php-dbgUpgrade php-json-debuginfoUpgrade php-dbg-debuginfoUpgrade php-xml-debuginfoUpgrade php-snmp-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pgsqlUpgrade php-odbcUpgrade php-pecl-rrd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pdo-debuginfoUpgrade php-mbstringUpgrade libzip-toolsUpgrade php-pecl-xdebug-debugsourceUpgrade php-soapUpgrade php-xmlUpgrade libzipUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-rrd-debugsourceUpgrade php-ldapUpgrade php-pecl-zipUpgrade php-pecl-apcuUpgrade php-pecl-apcu-develUpgrade libzip-debugsource | Mar 12, 2024 | Feb 27, 2020 |
| Suse | — | Upgrade php7-ftpUpgrade php72-fpmUpgrade php72-sqliteUpgrade php7-shmopUpgrade php72-odbcUpgrade php5-xmlrpcUpgrade php7-iconvUpgrade php5-gettextUpgrade php7-pharUpgrade php72-xmlrpcUpgrade php7-curlUpgrade php72-pspellUpgrade php7-ldapUpgrade php72-iconvUpgrade php7-opensslUpgrade php5-intlUpgrade php5-mbstringUpgrade php72-fastcgiUpgrade php7-develUpgrade php5-sysvmsgUpgrade php72-imapUpgrade php72-socketsUpgrade php5-exifUpgrade php7-bcmathUpgrade php5-xslUpgrade php7-snmpUpgrade php7-enchantUpgrade php7-pdoUpgrade php7-readlineUpgrade php7-posixUpgrade php72-snmpUpgrade php7-sysvsemUpgrade php72-pear-archive_tarUpgrade php7-pgsqlUpgrade php5-opensslUpgrade php72-zipUpgrade php7-tokenizerUpgrade php7-sysvmsgUpgrade php5-ctypeUpgrade php72-xmlreaderUpgrade php72-domUpgrade php5-posixUpgrade php72-tokenizerUpgrade php7-ctypeUpgrade php7-odbcUpgrade php7-zlibUpgrade php72-ftpUpgrade php7-mbstringUpgrade apache2-mod_php72Upgrade php5-pearUpgrade php72-ctypeUpgrade php72-jsonUpgrade php5-socketsUpgrade php72-readlineUpgrade php5-zlibUpgrade php72-tidyUpgrade php72-soapUpgrade php72-ldapUpgrade php5-sysvshmUpgrade php5-gdUpgrade php5-xmlwriterUpgrade php7-jsonUpgrade php72-gmpUpgrade php72-curlUpgrade php7-soapUpgrade php72-mysqlUpgrade php7-wddxUpgrade php5-iconvUpgrade php5-zipUpgrade php5-wddxUpgrade php5-domUpgrade php72-pcntlUpgrade php5-xmlreaderUpgrade php7-gdUpgrade php5-odbcUpgrade php7-calendarUpgrade php5-suhosinUpgrade php7-pearUpgrade php7-xmlreaderUpgrade php7-pcntlUpgrade php7Upgrade php72-fileinfoUpgrade php7-sysvshmUpgrade php7-sqliteUpgrade php5-pdoUpgrade php7-gmpUpgrade php5-develUpgrade php7-mysqlUpgrade php7-embedUpgrade php5-opcacheUpgrade php5-pspellUpgrade php7-gettextUpgrade php7-tidyUpgrade php72-pharUpgrade php5-pcntlUpgrade php7-testUpgrade php5-calendarUpgrade php5-bcmathUpgrade php5-bz2Upgrade php5Upgrade php5-ldapUpgrade php5-mcryptUpgrade php7-intlUpgrade php5-soapUpgrade php72-exifUpgrade php7-xmlrpcUpgrade php7-domUpgrade php5-jsonUpgrade php72-sysvmsgUpgrade php7-bz2Upgrade php5-dbaUpgrade php7-zipUpgrade php72-xslUpgrade php72-develUpgrade php5-sysvsemUpgrade php72-sodiumUpgrade php5-fpmUpgrade php72-opcacheUpgrade php7-fileinfoUpgrade php5-curlUpgrade php7-dbaUpgrade php5-pgsqlUpgrade php7-firebirdUpgrade php7-pear-archive_tarUpgrade php72-shmopUpgrade php72-bz2Upgrade php72-sysvshmUpgrade php72-pearUpgrade php72-mbstringUpgrade php5-gmpUpgrade php5-snmpUpgrade php5-shmopUpgrade php5-enchantUpgrade php72Upgrade php72-gdUpgrade php7-exifUpgrade php5-sqliteUpgrade php72-intlUpgrade php7-opcacheUpgrade php72-pdoUpgrade php7-xslUpgrade php7-sodiumUpgrade php72-pgsqlUpgrade php5-tokenizerUpgrade php5-pharUpgrade php72-sysvsemUpgrade php5-mysqlUpgrade php72-wddxUpgrade php72-bcmathUpgrade php72-enchantUpgrade php72-posixUpgrade php72-dbaUpgrade apache2-mod_php7Upgrade php5-fileinfoUpgrade php5-imapUpgrade php5-ftpUpgrade php7-fpmUpgrade php72-gettextUpgrade php72-zlibUpgrade apache2-mod_php5Upgrade php7-socketsUpgrade php7-xmlwriterUpgrade php72-calendarUpgrade php5-fastcgiUpgrade php72-xmlwriterUpgrade php72-opensslUpgrade php7-fastcgi | Mar 10, 2020 | Feb 27, 2020 |
| Ubuntu | — | Upgrade php7.2-cgiUpgrade php5-fpm (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade php7.3-cliUpgrade php7.0-cgiUpgrade libapache2-mod-php7.2Upgrade libapache2-mod-php7.3Upgrade libapache2-mod-php7.0Upgrade php5-cliUpgrade php7.3-fpmUpgrade php7.0-cliUpgrade php7.0-fpmUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php7.2-fpmUpgrade php5-cgi (Ubuntu Pro)Upgrade php7.3-mbstringUpgrade php7.2-cliUpgrade php5-cli (Ubuntu Pro)Upgrade php5-cgiUpgrade php5-fpmUpgrade php7.3-cgiUpgrade php7.2 | Apr 16, 2020 | Feb 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub