Skip to content
OpenAdvisories
Medium ALSA-2020:3662 22 CVEs

Moderate: php:7.3 security, bug fix, and enhancement update

Published Sep 8, 2020 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

Security Fix(es):

* php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

* php: Buffer over-read in exif_read_data() (CVE-2019-11040)

* php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte (CVE-2019-11045)

* php: Information disclosure in exif_read_data() (CVE-2019-11047)

* php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

* oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

* oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

* oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

* oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

* oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

* pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

* php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

* php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

* php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

* php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

* php: Information disclosure in exif_read_data() function (CVE-2020-7064)

* php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution (CVE-2020-7065)

* php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

* php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

* php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

* oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

* php: Information disclosure in function get_headers (CVE-2020-7066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 107

ReleasePackageFixed in
AlmaLinux · 8 apcu-panel 5.1.17-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 libzip 1.5.2-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 libzip 1.5.2-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 libzip 1.5.2-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 libzip-devel 1.5.2-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 libzip-devel 1.5.2-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 libzip-devel 1.5.2-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 libzip-tools 1.5.2-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 libzip-tools 1.5.2-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 libzip-tools 1.5.2-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-bcmath 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-bcmath 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-bcmath 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-cli 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-cli 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-cli 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-common 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-common 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-common 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-dba 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-dba 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-dba 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-dbg 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-dbg 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-dbg 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-devel 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-devel 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-devel 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-embedded 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-embedded 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-embedded 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-enchant 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-enchant 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-enchant 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-fpm 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-fpm 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-fpm 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-gd 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-gd 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-gd 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-gmp 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-gmp 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-gmp 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-intl 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-intl 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-intl 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-json 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-json 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-json 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-ldap 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-ldap 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-ldap 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-mbstring 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-mbstring 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-mbstring 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-mysqlnd 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-mysqlnd 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-mysqlnd 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-odbc 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-odbc 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-odbc 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-opcache 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-opcache 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-opcache 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-pdo 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-pdo 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-pdo 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-pear 1:1.10.9-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-pecl-apcu 5.1.17-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-pecl-apcu 5.1.17-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-pecl-apcu 5.1.17-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-pecl-apcu-devel 5.1.17-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-pecl-apcu-devel 5.1.17-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-pecl-apcu-devel 5.1.17-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-pecl-rrd 2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux · 8 php-pecl-rrd 2.0.1-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-pecl-rrd 2.0.1-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-pecl-xdebug 2.8.0-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-pecl-xdebug 2.8.0-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-pecl-xdebug 2.8.0-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-pecl-zip 1.15.4-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-pecl-zip 1.15.4-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-pecl-zip 1.15.4-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-pgsql 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-pgsql 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-pgsql 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-process 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-process 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-process 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-recode 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-recode 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-recode 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-snmp 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-snmp 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-snmp 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-soap 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-soap 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-soap 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-xml 7.3.20-1.module_el8.4.0+2229+b272fdef
AlmaLinux · 8 php-xml 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-xml 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-xmlrpc 7.3.20-1.module_el8.5.0+152+112d3b8c
AlmaLinux · 8 php-xmlrpc 7.3.20-1.module_el8.3.0+2009+b272fdef
AlmaLinux · 8 php-xmlrpc 7.3.20-1.module_el8.4.0+2229+b272fdef

Vulnerabilities 22

  • High 7.5
    CVE-2020-7062

    Null Pointer Dereference in PHP Session Upload Progress

    In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload proce…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 7.4
    CVE-2020-7065

    mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full

    In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially c…

    PHP Group PHP php7 php7.4 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2020-7059

    OOB read in php_strip_tags_ex

    When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to informa…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2020-7060

    global buffer-overflow in mbfl_filt_conv_big5_wchar

    When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buff…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2020-7064

    Use-of-uninitialized-value in exif

    In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to inform…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2020-7063

    Files added to tar with Phar::buildFromIterator have all-access permissions

    In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesys…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2019-11048

    Temporary files are not cleaned after OOM when parsing HTTP request data

    In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop p…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2020-7066

    get_headers() silently truncates after a null byte

    In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect a…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 5.1
    CVE-2019-20454

    An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match special…

    pcre2 pcre2 Debian Ubuntu
  • Medium 4.8
    CVE-2019-11040

    Heap buffer overflow in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11041

    heap-buffer-overflow on exif_scan_thumbnail in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11042

    heap-buffer-overflow on exif_process_user_comment in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11047

    Heap-buffer-overflow READ in exif

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer.…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11050

    Use-after-free in exif parsing under memory sanitizer

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer.…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.2
    CVE-2019-11039

    Out-of-bounds read in iconv.c

    Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Low 3.7
    CVE-2019-11045

    DirectoryIterator class silently truncates after a null byte

    In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Unscored —
    CVE-2019-13224

    A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information …

    php5 php7 libonig libonig Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-13225

    A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial o…

    libonig Debian
  • Unscored —
    CVE-2019-16163

    Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.

    libonig libonig Debian Ubuntu
  • Unscored —
    CVE-2019-19203 Public exploit

    An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UCh…

    libonig libonig Debian Ubuntu
  • Unscored —
    CVE-2019-19204 Public exploit

    An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as…

    libonig libonig Debian Ubuntu
  • Unscored —
    CVE-2019-19246

    Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_m…

    libonig libonig Debian Ubuntu

References

  • report
    https://vulners.com/cve/CVE-2019-11039
  • report
    https://vulners.com/cve/CVE-2019-11040
  • report
    https://vulners.com/cve/CVE-2019-11041
  • report
    https://vulners.com/cve/CVE-2019-11042
  • report
    https://vulners.com/cve/CVE-2019-11045
  • report
    https://vulners.com/cve/CVE-2019-11047
  • report
    https://vulners.com/cve/CVE-2019-11048
  • report
    https://vulners.com/cve/CVE-2019-11050
  • report
    https://vulners.com/cve/CVE-2019-13224
  • report
    https://vulners.com/cve/CVE-2019-13225
  • report
    https://vulners.com/cve/CVE-2019-16163
  • report
    https://vulners.com/cve/CVE-2019-19203
  • report
    https://vulners.com/cve/CVE-2019-19204
  • report
    https://vulners.com/cve/CVE-2019-19246
  • report
    https://vulners.com/cve/CVE-2019-20454
  • report
    https://vulners.com/cve/CVE-2020-7059
  • report
    https://vulners.com/cve/CVE-2020-7060
  • report
    https://vulners.com/cve/CVE-2020-7062
  • report
    https://vulners.com/cve/CVE-2020-7063
  • report
    https://vulners.com/cve/CVE-2020-7064
  • report
    https://vulners.com/cve/CVE-2020-7065
  • report
    https://vulners.com/cve/CVE-2020-7066