The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3287 advisory.

    [5.3.3-50]
    - fix underflow in env_path_info in fpm_main.c CVE-2019-11043

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The PHP project reports :

The PHP development team announces the immediate availability of PHP 7.3.11. This is a security release which also contains several bug fixes.

The PHP development team announces the immediate availability of PHP 7.2.24. This is a security release which also contains several bug fixes.

The PHP development team announces the immediate availability of PHP 7.1.33. This is a security release which also contains several bug fixes.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has php packages installed that are affected by a vulnerability:

  - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24     and 7.3.x below 7.3.11 in certain configurations of FPM     setup it is possible to cause FPM module to write past     allocated buffers into the space reserved for FCGI     protocol data, thus opening the possibility of remote     code execution. (CVE-2019-11043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3736 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0049 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-11043:
    In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of     FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for     FCGI protocol data, thus opening the possibility of remote code execution.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has php packages installed that are affected by a vulnerability:

  - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24     and 7.3.x below 7.3.11 in certain configurations of FPM     setup it is possible to cause FPM module to write past     allocated buffers into the space reserved for FCGI     protocol data, thus opening the possibility of remote     code execution. (CVE-2019-11043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-4396:02 advisory.

    * php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3736 advisory.

    php     [7.3.5-5]
    - fix underflow in env_path_info in fpm_main.c CVE-2019-11043

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Emil Lerner, beched and d90pwn found a buffer underflow in php5-fpm, a Fast Process Manager for the PHP language, which can lead to remote code execution.

Instances are vulnerable depending on the web server configuration, in particular PATH_INFO handling. For a full list of preconditions, check: https://github.com/neex/phuip-fpizdam

For Debian 8 'Jessie', this problem has been fixed in version 5.6.40+dfsg-0+deb8u7.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Emil Lerner and Andrew Danau discovered that insufficient validation in the path handling code of PHP FPM could result in the execution of arbitrary code in some setups.

This update for php7 fixes the following issues :

Security issue fixed :

  - CVE-2019-11043: Fixed possible remote code execution via     env_path_info underflow in fpm_main.c (bsc#1154999).

This update was imported from the SUSE:SLE-15:Update update project.

This update for php7 fixes the following issues :

Security issue fixed :

CVE-2019-11043: Fixed possible remote code execution via env_path_info underflow in fpm_main.c (bsc#1154999).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
130497	Oracle Linux 6 : php (ELSA-2019-3287)	Nessus	Oracle Linux Local Security Checks	11/4/2019	10/22/2024	critical
130617	FreeBSD : php -- env_path_info underflow in fpm_main.c can lead to RCE (6a7c2ab0-00dd-11ea-83ce-705a0f828759)	Nessus	FreeBSD Local Security Checks	11/7/2019	12/6/2022	critical
133087	NewStart CGSL CORE 5.05 / MAIN 5.05 : php Vulnerability (NS-SA-2020-0001)	Nessus	NewStart CGSL Local Security Checks	1/20/2020	4/25/2023	critical
130739	RHEL 8 : php:7.3 (RHSA-2019:3736)	Nessus	Red Hat Local Security Checks	11/8/2019	11/6/2024	critical
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	9/3/2021	5/10/2024	critical
239623	TencentOS Server 3: php:7.3 (TSSA-2022:0049)	Nessus	Tencent Local Security Checks	6/16/2025	12/4/2025	critical
131418	NewStart CGSL CORE 5.04 / MAIN 5.04 : php Vulnerability (NS-SA-2019-0214)	Nessus	NewStart CGSL Local Security Checks	12/2/2019	4/25/2023	critical
289284	MiracleLinux 7 : php-5.4.16-46.1.0.1.el7.AXS7 (AXSA:2019-4396:02)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/17/2026	critical
131271	Oracle Linux 8 : php:7.3 (ELSA-2019-3736)	Nessus	Oracle Linux Local Security Checks	11/25/2019	11/1/2024	critical
130283	Debian DLA-1970-1 : php5 security update	Nessus	Debian Local Security Checks	10/28/2019	4/16/2024	critical
130349	Debian DSA-4552-1 : php7.0 - security update	Nessus	Debian Local Security Checks	10/29/2019	12/6/2022	critical
130580	openSUSE Security Update : php7 (openSUSE-2019-2441)	Nessus	SuSE Local Security Checks	11/6/2019	12/5/2022	critical
130390	SUSE SLES12 Security Update : php7 (SUSE-SU-2019:2809-1)	Nessus	SuSE Local Security Checks	10/30/2019	4/25/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical