rewindex

RewindexCVEs

CVE-2019-11043: Underflow in PHP-FPM can lead to RCE

High · CVSS 8.7 (CVSS 3.1)KEV known exploitedEPSS 99.7%, 100th percentilePublished Updated Assigner: php

In CISA’s Known Exploited Vulnerabilities catalog: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability.

Added , federal remediation due . Known ransomware use: Known.

Required action: Apply updates per vendor instructions.

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N · CWE-120

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

PHP: PHP

References

All CVEsMarkdownJSON