blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2019-11049

CRITICAL 9.8 CVSS 3.1
Published
December 23, 2019
Last modified
August 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-415
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.

Affected products and versions

  • PHP — From 7.3.0 (including) to 7.3.13 (including)
  • PHP versions 7.4.0

References

  • bugs.php.net https://bugs.php.net/bug.php?id=78943 Mailing List, Patch, Vendor Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
  • seclists.org https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20200103-0002/ Third Party Advisory
  • www.debian.org https://www.debian.org/security/2020/dsa-4626 Third Party Advisory
  • www.tenable.com https://www.tenable.com/security/tns-2021-14 Third Party Advisory
  • nvd.nist.gov Official NVD record