CVE catalog

CVE-2020-7062

Security update for php72

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
3.58% · Oct 25, 2026

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp7.4117.4.3-1fixed
Ubuntuphp5pro5.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.19vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.20vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.21vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.22vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.23vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.24vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.25vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.26vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.27vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm8vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm10vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm11fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.18-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.22-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.25-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.28-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.30-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.32-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.5vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.6vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.7vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.9vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.11vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.12vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.14fixed
Ubuntuphp7.218.047.2.1-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.3-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.5-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.10-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.17-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.3vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.4fixed
Ubuntuphp5pro5.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.19vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.20vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.21vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.22vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.23vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.24vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.25vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.26vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.27vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm8vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm10vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm11fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.18-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.22-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.25-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.28-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.30-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.32-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.5vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.6vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.7vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.9vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.11vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.12vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.14fixed
Ubuntuphp7.218.047.2.1-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.3-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.5-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.10-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.17-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.3vulnerable
Ubuntuphp7.218.047.2.24-0ubuntu0.18.04.4fixed
Debianphp585.6.11+dfsg-1vulnerable
Debianphp585.6.12+dfsg-0+deb8u1vulnerable
Debianphp585.6.12+dfsg-1vulnerable
Debianphp585.6.13+dfsg-0+deb8u1vulnerable
Debianphp585.6.13+dfsg-1vulnerable
Debianphp585.6.13+dfsg-2vulnerable
Debianphp585.6.14+dfsg-0+deb8u1vulnerable
Debianphp585.6.14+dfsg-1vulnerable
Debianphp585.6.15+dfsg-1vulnerable
Debianphp585.6.16+dfsg-1vulnerable
Debianphp585.6.16+dfsg-2vulnerable
Debianphp585.6.16+dfsg-3vulnerable
Debianphp585.6.16+dfsg-4vulnerable
Debianphp585.6.17+dfsg-0+deb8u1vulnerable
Debianphp585.6.17+dfsg-1vulnerable
Debianphp585.6.17+dfsg-3vulnerable
Debianphp585.6.18+dfsg-1vulnerable
Debianphp585.6.19+dfsg-0+deb8u1vulnerable
Debianphp585.6.19+dfsg-1vulnerable
Debianphp585.6.19+dfsg-2vulnerable
Debianphp585.6.20+dfsg-0+deb8u1vulnerable
Debianphp585.6.20+dfsg-1vulnerable
Debianphp585.6.21+dfsg-1vulnerable
Debianphp585.6.21+dfsg-2vulnerable
Debianphp585.6.22+dfsg-0+deb8u1vulnerable
Debianphp585.6.22+dfsg-1vulnerable
Debianphp585.6.22+dfsg-2vulnerable
Debianphp585.6.23+dfsg-0+deb8u1vulnerable
Debianphp585.6.23+dfsg-1vulnerable
Debianphp585.6.24+dfsg-0+deb8u1vulnerable
Debianphp585.6.24+dfsg-1vulnerable
Debianphp585.6.26+dfsg-0+deb8u1vulnerable
Debianphp585.6.26+dfsg-1vulnerable
Debianphp585.6.27+dfsg-0+deb8u1vulnerable
Debianphp585.6.28+dfsg-0+deb8u1vulnerable
Debianphp585.6.29+dfsg-0+deb8u1vulnerable
Debianphp585.6.30+dfsg-0+deb8u1vulnerable
Debianphp585.6.33+dfsg-0+deb8u1vulnerable
Debianphp585.6.36+dfsg-0+deb8u1vulnerable
Debianphp585.6.37+dfsg-0+deb8u1vulnerable
Debianphp585.6.38+dfsg-0+deb8u1vulnerable
Debianphp585.6.39+dfsg-0+deb8u1vulnerable
Debianphp585.6.39+dfsg-0+deb8u2vulnerable
Debianphp585.6.40+dfsg-0+deb8u1vulnerable
Debianphp585.6.40+dfsg-0+deb8u2vulnerable
Debianphp585.6.40+dfsg-0+deb8u3vulnerable
Debianphp585.6.40+dfsg-0+deb8u4vulnerable
Debianphp585.6.40+dfsg-0+deb8u5vulnerable
Debianphp585.6.40+dfsg-0+deb8u6vulnerable
Debianphp585.6.40+dfsg-0+deb8u7vulnerable
Debianphp585.6.40+dfsg-0+deb8u8vulnerable
Debianphp585.6.40+dfsg-0+deb8u9vulnerable
Debianphp585.6.7+dfsg-1vulnerable
Debianphp585.6.9+dfsg-0+deb8u1vulnerable
Debianphp585.6.9+dfsg-1vulnerable
Debianphp585.6.40+dfsg-0+deb8u10fixed
Susephp5linux enterprise module for web and scripting 125.5.14-109.71.1fixed
Susephp5linux enterprise software development kit 12 sp45.5.14-109.71.1fixed
Susephp72linux enterprise module for web and scripting 127.2.5-1.40.1fixed
Susephp72linux enterprise software development kit 12 sp47.2.5-1.40.1fixed
Susephp72linux enterprise software development kit 12 sp57.2.5-1.40.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp7.4deb117.4.3-1Not reportedDEBIAN-CVE-2020-7062Not reported
Ubuntuphp5debpro5.5.9+dfsg-1ubuntu4.29+esm11Not reportedUBUNTU-CVE-2020-7062Not reported
Ubuntuphp7.0deb16.047.0.33-0ubuntu0.16.04.14Not reportedUBUNTU-CVE-2020-7062Not reported
Ubuntuphp7.2deb18.047.2.24-0ubuntu0.18.04.4Not reportedUBUNTU-CVE-2020-7062Not reported
Ubuntuphp5debpro5.5.9+dfsg-1ubuntu4.29+esm11Not reportedUSN-4330-1Not reported
Ubuntuphp7.0deb16.047.0.33-0ubuntu0.16.04.14Not reportedUSN-4330-1Not reported
Ubuntuphp7.2deb18.047.2.24-0ubuntu0.18.04.4Not reportedUSN-4330-1Not reported
Debianphp5deb85.6.40+dfsg-0+deb8u10Not reportedDLA-2160-1Not reported
Susephp5rpmlinux enterprise module for web and scripting 125.5.14-109.71.1Not reportedSUSE-SU-2020:0658-1Not reported
Susephp5rpmlinux enterprise software development kit 12 sp45.5.14-109.71.1Not reportedSUSE-SU-2020:0658-1Not reported
Susephp72rpmlinux enterprise module for web and scripting 127.2.5-1.40.1Not reportedSUSE-SU-2020:0647-1Not reported
Susephp72rpmlinux enterprise software development kit 12 sp47.2.5-1.40.1Not reportedSUSE-SU-2020:0647-1Not reported
Susephp72rpmlinux enterprise software development kit 12 sp57.2.5-1.40.1Not reportedSUSE-SU-2020:0647-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References