Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Remediation

References

CVE-2019-11043

Related Vulnerabilities

WordPress Plugin SportsPress-Sports Club & League Manager Cross-Site Scripting (2.7.1)

Zope Web Application Server Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability (CVE-2021-32811)

MySQL CVE-2022-21331 Vulnerability (CVE-2022-21331)

SharePoint CVE-2020-16979 Vulnerability (CVE-2020-16979)

Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-18671)

Severity

Critical

Classification

CVE-2019-11043 CWE-787 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities