ISOMAN

CVE

CVE-2019-11043

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Severity
HIGH
CVSS
8.7
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html
  2. http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html
  3. http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html
  4. http://seclists.org/fulldisclosure/2020/Jan/40
  5. https://access.redhat.com/errata/RHSA-2019:3286
  6. https://access.redhat.com/errata/RHSA-2019:3287
  7. https://access.redhat.com/errata/RHSA-2019:3299
  8. https://access.redhat.com/errata/RHSA-2019:3300
  9. https://access.redhat.com/errata/RHSA-2019:3724
  10. https://access.redhat.com/errata/RHSA-2019:3735
  11. https://access.redhat.com/errata/RHSA-2019:3736
  12. https://access.redhat.com/errata/RHSA-2020:0322
  13. https://bugs.php.net/bug.php?id=78599
  14. https://github.com/neex/phuip-fpizdam
  15. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/
  16. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/
  17. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/
  18. https://seclists.org/bugtraq/2020/Jan/44
  19. https://security.netapp.com/advisory/ntap-20191031-0003/
  20. https://support.apple.com/kb/HT210919