Description

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.

Remediation

References

CVE-2019-9024

Related Vulnerabilities

WordPress Plugin Total Team Lite-Responsive Team Manager/Showcase for WordPress includes Backdoor [Only if downloaded via the vendor website] (1.1.1)

WordPress Plugin Bricks Remote Code Execution (1.9.6)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Security Bypass (2.0.13)

ownCloud Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2013-2085)

WordPress Plugin SendPress Newsletters Cross-Site Scripting (1.20.7.10)

Severity

High

Classification

CVE-2019-9024 CWE-125 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities