CVE-2019-11048

In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
phpCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
VendorProductVersion
phpphp
7.2.0 ≤
𝑥
< 7.2.31
phpphp
7.3.0 ≤
𝑥
< 7.3.18
phpphp
7.4.0 ≤
𝑥
< 7.4.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
7.4.33-1+deb11u5
fixed
bullseye (security)
7.4.33-1+deb11u6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
focal
dne
eoan
dne
bionic
dne
xenial
dne
trusty
Fixed 5.5.9+dfsg-1ubuntu4.29+esm12
released
php7.0
focal
dne
eoan
dne
bionic
dne
xenial
Fixed 7.0.33-0ubuntu0.16.04.15
released
trusty
dne
php7.2
focal
dne
eoan
dne
bionic
Fixed 7.2.24-0ubuntu0.18.04.6
released
xenial
dne
trusty
dne
php7.3
focal
dne
eoan
Fixed 7.3.11-0ubuntu0.19.10.6
released
bionic
dne
xenial
dne
trusty
dne
php7.4
focal
Fixed 7.4.3-4ubuntu2.2
released
eoan
dne
bionic
dne
xenial
dne
trusty
dne
References