CVEvulnerability
CVE-2019-11045
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-12-23
- Last modified
- 2026-08-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-170, CWE-74
Description
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Affected configurations
• php php (>= 7.2.0 <= 7.2.26)
• php php (>= 7.3.0 <= 7.3.13)
• php php 7.4.0
• fedoraproject fedora 30
• fedoraproject fedora 31
• debian debian linux 8.0
• debian debian linux 9.0
• debian debian linux 10.0
• opensuse leap 15.1
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.04
• canonical ubuntu linux 19.10
• tenable security center (< 5.19.0)
Related
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html Mailing List, Third Party Advisory
- https://bugs.php.net/bug.php?id=78863 Exploit, Mailing List, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Feb/31 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2021/Jan/3 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200103-0002/ Third Party Advisory
- https://usn.ubuntu.com/4239-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4626 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4628 Third Party Advisory
- https://www.tenable.com/security/tns-2021-14 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html Mailing List, Third Party Advisory
- https://bugs.php.net/bug.php?id=78863 Exploit, Mailing List, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Feb/31 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2021/Jan/3 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200103-0002/ Third Party Advisory
- https://usn.ubuntu.com/4239-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4626 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4628 Third Party Advisory
- https://www.tenable.com/security/tns-2021-14 Third Party Advisory