CVE-2019-11043 — Underflow in PHP-FPM can lead to RCE

Affected: PHP

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

USN-4166-1 — php7.0, php7.2, php7.3 vulnerability

Affected: Ubuntu:16.04:LTS: php7.0, Ubuntu:18.04:LTS: php7.2

It was discovered that PHP incorrectly handled certain paths when being used in FastCGI configurations. A remote attacker could possibly use this issue to execute arbitrary code.

Most recent entries from all

CVE-2019-11043 — Underflow in PHP-FPM can lead to RCE

USN-4166-1 — php7.0, php7.2, php7.3 vulnerability