Description
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.
Remediation
References
Related Vulnerabilities
MySQL CVE-2020-14868 Vulnerability (CVE-2020-14868)
Oracle JRE CVE-2013-5805 Vulnerability (CVE-2013-5805)
WordPress Plugin YITH WooCommerce Product Add-Ons Multiple Vulnerabilities (2.0.7)
GlassFish CVE-2017-3247 Vulnerability (CVE-2017-3247)
PrestaShop Improper Restriction of Rendered UI Layers or Frames Vulnerability (CVE-2018-7491)