CVE-2019-11043

Published: Oct 28, 2019Modified: Jun 17, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Affected (66)

Products: Php: Php · Canonical: Ubuntu Linux · Debian: Debian Linux · +3 more

Show all products

1 product

1 product

1 product

1 product

1 product

18 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Eus Compute Node

Enterprise Linux For Arm 64

Enterprise Linux For Arm 64 Eus

Enterprise Linux For Ibm Z Systems

Enterprise Linux For Ibm Z Systems Eus

Enterprise Linux For Power Big Endian

Enterprise Linux For Power Big Endian Eus

Enterprise Linux For Power Little Endian

Enterprise Linux For Power Little Endian Eus

Enterprise Linux For Scientific Computing

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Software Collections

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 7.1.0 to 7.1.33
Php Php	From 7.2.0 to 7.2.24
Php Php	From 7.3.0 to 7.3.11

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04
Canonical Ubuntu Linux	Version 19.10

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Tenable.sc	Before 5.19.0

Configuration F

51 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Eus	Version 7.7
Redhat Enterprise Linux Eus	Version 8.1
Redhat Enterprise Linux Eus	Version 8.2
Redhat Enterprise Linux Eus	Version 8.4
Redhat Enterprise Linux Eus	Version 8.6
Redhat Enterprise Linux Eus	Version 8.8
Redhat Enterprise Linux Eus Compute Node	Version 7.7
Redhat Enterprise Linux For Arm 64	Version 8.0_aarch64
Redhat Enterprise Linux For Arm 64 Eus	Version 8.1_aarch64
Redhat Enterprise Linux For Arm 64 Eus	Version 8.2_aarch64
Redhat Enterprise Linux For Arm 64 Eus	Version 8.4_aarch64
Redhat Enterprise Linux For Arm 64 Eus	Version 8.6_aarch64
Redhat Enterprise Linux For Arm 64 Eus	Version 8.8_aarch64
Redhat Enterprise Linux For Ibm Z Systems	Version 6.0_s390x
Redhat Enterprise Linux For Ibm Z Systems	Version 7.0_s390x
Redhat Enterprise Linux For Ibm Z Systems	Version 8.0_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus	Version 7.7_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus	Version 8.1_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus	Version 8.2_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus	Version 8.4_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus	Version 8.6_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus	Version 8.8_s390x
Redhat Enterprise Linux For Power Big Endian	Version 6.0_ppc64
Redhat Enterprise Linux For Power Big Endian	Version 7.0_ppc64
Redhat Enterprise Linux For Power Big Endian Eus	Version 7.7_ppc64
Redhat Enterprise Linux For Power Little Endian	Version 7.0_ppc64le
Redhat Enterprise Linux For Power Little Endian	Version 8.0_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus	Version 7.7_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus	Version 8.1_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus	Version 8.2_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus	Version 8.4_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus	Version 8.6_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus	Version 8.8_ppc64le
Redhat Enterprise Linux For Scientific Computing	Version 7.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.7
Redhat Enterprise Linux Server Aus	Version 8.2
Redhat Enterprise Linux Server Aus	Version 8.4
Redhat Enterprise Linux Server Aus	Version 8.6
Redhat Enterprise Linux Server Tus	Version 7.7
Redhat Enterprise Linux Server Tus	Version 8.2
Redhat Enterprise Linux Server Tus	Version 8.4
Redhat Enterprise Linux Server Tus	Version 8.6
Redhat Enterprise Linux Server Tus	Version 8.8
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0
Redhat Software Collections	Version 1.0

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (55)

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html

Source: security@php.net

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html

Source: security@php.net

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html

Source: security@php.net

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2020/Jan/40

Source: security@php.net

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2019:3286

Source: security@php.net

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3287

Source: security@php.net

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3299

Source: security@php.net

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3300

Source: security@php.net

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3724

Source: security@php.net

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3735

Source: security@php.net

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3736

Source: security@php.net

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0322

Source: security@php.net

Third Party Advisory

https://bugs.php.net/bug.php?id=78599

Source: security@php.net

ExploitIssue TrackingPatchVendor Advisory

https://github.com/neex/phuip-fpizdam

Source: security@php.net

ExploitThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/

Source: security@php.net

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/

Source: security@php.net

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/

Source: security@php.net

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2020/Jan/44

Source: security@php.net

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20191031-0003/

Source: security@php.net

Third Party Advisory

https://support.apple.com/kb/HT210919

Source: security@php.net

Third Party Advisory

https://support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_medium=RSS

Source: security@php.net

Third Party Advisory

https://usn.ubuntu.com/4166-1/

Source: security@php.net

Third Party Advisory

https://usn.ubuntu.com/4166-2/

Source: security@php.net

Third Party Advisory

https://www.debian.org/security/2019/dsa-4552

Source: security@php.net

Mailing ListThird Party Advisory

https://www.debian.org/security/2019/dsa-4553

Source: security@php.net

Mailing ListThird Party Advisory

https://www.synology.com/security/advisory/Synology_SA_19_36

Source: security@php.net

Third Party Advisory

https://www.tenable.com/security/tns-2021-14

Source: security@php.net

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html