Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2019-11043

Underflow in PHP-FPM can lead to RCE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP PHP

  • 7.1.x to < 7.1.33affected
  • 7.2.x to < 7.2.24affected
  • 7.3.x to < 7.3.11affected

References