blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2019-11043

CRITICAL 9.8 CVSS 3.1
Published
October 28, 2019
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
security@php.net
Weakness
CWE-120, CWE-787
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Affected products and versions

  • PHP — From 7.1.0 (including) to 7.1.33 (excluding)
  • PHP — From 7.2.0 (including) to 7.2.24 (excluding)
  • PHP — From 7.3.0 (including) to 7.3.11 (excluding)

References

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html Mailing List, Third Party Advisory
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html Mailing List, Third Party Advisory
  • packetstormsecurity.com http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
  • seclists.org http://seclists.org/fulldisclosure/2020/Jan/40 Mailing List, Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:3286 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:3287 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:3300 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:3724 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:3735 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:3736 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2020:0322 Third Party Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=78599 Exploit, Issue Tracking, Patch, Vendor Advisory
  • github.com https://github.com/neex/phuip-fpizdam Exploit, Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/ Mailing List, Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/ Mailing List, Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/ Mailing List, Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2020/Jan/44 Mailing List, Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20191031-0003/ Third Party Advisory
  • support.apple.com https://support.apple.com/kb/HT210919 Third Party Advisory
  • support.f5.com https://support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_medium=RSS Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/4166-1/ Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/4166-2/ Third Party Advisory
  • www.debian.org https://www.debian.org/security/2019/dsa-4552 Mailing List, Third Party Advisory
  • www.debian.org https://www.debian.org/security/2019/dsa-4553 Mailing List, Third Party Advisory
  • www.synology.com https://www.synology.com/security/advisory/Synology_SA_19_36 Third Party Advisory
  • www.tenable.com https://www.tenable.com/security/tns-2021-14 Third Party Advisory
  • www.cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043 US Government Resource
  • nvd.nist.gov Official NVD record