CVE-2019-11043
- Source
- https://cve.org/CVERecord?id=CVE-2019-11043
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11043.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-11043
- Downstream
- Related
- Published
- 2019-10-28T15:15:13.863Z
- Modified
- 2026-04-16T04:31:21.656987632Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
- References
-
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043
- https://usn.ubuntu.com/4166-2/
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html
- https://access.redhat.com/errata/RHSA-2019:3286
- https://access.redhat.com/errata/RHSA-2019:3287
- https://access.redhat.com/errata/RHSA-2019:3736
- https://access.redhat.com/errata/RHSA-2020:0322
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html
- http://seclists.org/fulldisclosure/2020/Jan/40
- https://access.redhat.com/errata/RHSA-2019:3300
- https://access.redhat.com/errata/RHSA-2019:3735
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/
- https://seclists.org/bugtraq/2020/Jan/44
- https://security.netapp.com/advisory/ntap-20191031-0003/
- https://support.f5.com/csp/article/K75408500?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4166-1/
- https://www.debian.org/security/2019/dsa-4552
- https://www.debian.org/security/2019/dsa-4553
- https://www.synology.com/security/advisory/Synology_SA_19_36
- https://www.tenable.com/security/tns-2021-14
- https://access.redhat.com/errata/RHSA-2019:3299
- https://access.redhat.com/errata/RHSA-2019:3724
- https://support.apple.com/kb/HT210919
- https://bugs.php.net/bug.php?id=78599
- http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html
- https://github.com/neex/phuip-fpizdam
Affected packages
Git / github.com/php/php-src
Affected ranges
- Type
- GIT
- Repo
- https://github.com/php/php-src
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Database specific
{ "versions": [ { "introduced": "7.1.0" }, { "fixed": "7.1.33" }, { "introduced": "7.2.0" }, { "fixed": "7.2.24" }, { "introduced": "7.3.0" }, { "fixed": "7.3.11" }, { "introduced": "0" }, { "last_affected": "1.0" }, { "introduced": "0" }, { "last_affected": "8.0" }, { "introduced": "0" }, { "last_affected": "7.0" }, { "introduced": "0" }, { "last_affected": "8.1" }, { "introduced": "0" }, { "last_affected": "8.2" }, { "introduced": "0" }, { "last_affected": "8.4" }, { "introduced": "0" }, { "last_affected": "7.0" }, { "introduced": "0" }, { "last_affected": "7.0" }, { "introduced": "0" }, { "last_affected": "8.2" }, { "introduced": "0" }, { "last_affected": "8.4" }, { "introduced": "0" }, { "last_affected": "8.2" }, { "introduced": "0" }, { "last_affected": "8.4" }, { "introduced": "0" }, { "last_affected": "7.0" } ] }
Affected versions
Other
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS
RELEASE_1_0
security-audit-2024
php-7.*
php-7.0.0
php-7.0.0RC1
php-7.0.0RC2
php-7.0.0RC3
php-7.0.0RC4
php-7.0.0RC5
php-7.0.0RC6
php-7.0.0RC7
php-7.0.0RC8
php-7.0.0alpha1
php-7.0.0alpha2
php-7.0.0beta1
php-7.0.0beta2
php-7.0.0beta3
php-7.1.31
php-7.1.32
php-7.3.11RC1
php-8.*
php-8.0.0
php-8.1.0
php-8.2.0
php-8.4.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11043.json"
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "14.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "18.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "19.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "19.10"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "10.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "29"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "30"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "31"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.19.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.7"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.6"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.7"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0_aarch64"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.1_aarch64"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.2_aarch64"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.4_aarch64"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.6_aarch64"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8_aarch64"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.0_s390x"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0_s390x"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0_s390x"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.7_s390x"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.1_s390x"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.2_s390x"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.4_s390x"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.6_s390x"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8_s390x"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.0_ppc64"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0_ppc64"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.7_ppc64"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0_ppc64le"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0_ppc64le"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.7_ppc64le"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.1_ppc64le"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.2_ppc64le"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.4_ppc64le"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.6_ppc64le"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8_ppc64le"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.7"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.6"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.7"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.6"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.0"
}
]
}
]