CVE-2019-11044
CVE-2019-11044 · link() silently truncates after a null byte on Windows
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
CVSS 3.7 · Low · EPSS 5.1% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
php
- Versions
- ≥ 7.2.x, < 7.2.26: Affected (custom)
- ≥ 7.3.x, < 7.3.13: Affected (custom)
- ≥ 7.4.x, < 7.4.1: Affected (custom)
Update to 7.2.26; Update to 7.3.13; Update to 7.4.1
Original sources
- https://bugs.php.net/bug.php?id=78862
- https://security.netapp.com/advisory/ntap-20200103-0002/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
- https://www.tenable.com/security/tns-2021-14
- https://nvd.nist.gov/vuln/detail/CVE-2019-11044