CVE-2020-7062: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days.

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.10 only
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Opensuse Leap: version 15.1 only
• PHP PHP: from 7.2.0, up to and including 7.2.27; from 7.3.0, up to and including 7.3.14; from 7.4.0, up to and including 7.4.2

Published 2020-02-27. Last modified 2026-06-17.