Detections
Analytics
CVE-2019-11045
medium
Description
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
References
https://www.tenable.com/security/tns-2021-14
https://www.debian.org/security/2020/dsa-4628
https://www.debian.org/security/2020/dsa-4626
https://usn.ubuntu.com/4239-1/
https://security.netapp.com/advisory/ntap-20200103-0002/
https://seclists.org/bugtraq/2021/Jan/3
https://seclists.org/bugtraq/2020/Feb/31
https://seclists.org/bugtraq/2020/Feb/27
https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html