Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Remediation

References

CVE-2019-11043

Related Vulnerabilities

CubeCart Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-38130)

MySQL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2004-0836)

WordPress Plugin Infusionsoft Gravity Forms Add-on Cross-Site Scripting (1.5.11)

PHP CVE-2013-7345 Vulnerability (CVE-2013-7345)

CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-4060)

Severity

Critical

Classification

CVE-2019-11043 CWE-787 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities