CVE-2019-11043

HIGH

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

References

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html

https://access.redhat.com/errata/RHSA-2019:3286

https://access.redhat.com/errata/RHSA-2019:3287

https://access.redhat.com/errata/RHSA-2019:3299

https://access.redhat.com/errata/RHSA-2019:3300

https://access.redhat.com/errata/RHSA-2019:3724

https://access.redhat.com/errata/RHSA-2019:3735

https://access.redhat.com/errata/RHSA-2019:3736

https://bugs.php.net/bug.php?id=78599

https://github.com/neex/phuip-fpizdam

https://lists.fedoraproject.org/archives/list/[email protected]/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/

https://lists.fedoraproject.org/archives/list/[email protected]/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/

https://lists.fedoraproject.org/archives/list/[email protected]/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/

https://security.netapp.com/advisory/ntap-20191031-0003/

https://support.f5.com/csp/article/K75408500?utm_source=f5support&utm_medium=RSS

https://usn.ubuntu.com/4166-1/

https://usn.ubuntu.com/4166-2/

https://www.debian.org/security/2019/dsa-4552

https://www.debian.org/security/2019/dsa-4553

Details

Source: MITRE

Published: 2019-10-28

Updated: 2019-10-30

Type: CWE-787

Risk Information

CVSS v2.0

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3.0

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL