CVE-2019-11048

EUVD-2019-2756
In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
phpCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
phpphp
7.2.0 ≤
𝑥
< 7.2.31
phpphp
7.3.0 ≤
𝑥
< 7.3.18
phpphp
7.4.0 ≤
𝑥
< 7.4.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
7.4.33-1+deb11u5
fixed
bullseye (security)
7.4.33-1+deb11u6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
bionic
dne
eoan
dne
focal
dne
trusty
Fixed 5.5.9+dfsg-1ubuntu4.29+esm12
released
xenial
dne
php7.0
bionic
dne
eoan
dne
focal
dne
trusty
dne
xenial
Fixed 7.0.33-0ubuntu0.16.04.15
released
php7.2
bionic
Fixed 7.2.24-0ubuntu0.18.04.6
released
eoan
dne
focal
dne
trusty
dne
xenial
dne
php7.3
bionic
dne
eoan
Fixed 7.3.11-0ubuntu0.19.10.6
released
focal
dne
trusty
dne
xenial
dne
php7.4
bionic
dne
eoan
dne
focal
Fixed 7.4.3-4ubuntu2.2
released
trusty
dne
xenial
dne
References