CVE-2019-11049
php: double free when supplying custom headers to mail function
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Amazon (yüksek), Red Hat (orta).
Açıklama
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | php72, php72-bcmath, php72-cli ve 61 tane daha | 7.2.26-1.19.amzn1 ve 1 tane daha |
1 kaynaktaki 64 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | php72 | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-bcmath | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-cli | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-common | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-dba | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-dbg | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-debuginfo | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-devel | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-embedded | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-enchant | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-fpm | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-gd | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-gmp | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-imap | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-intl | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-json | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-ldap | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-mbstring | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-mysqlnd | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-odbc | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-opcache | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-pdo | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-pdo-dblib | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-pgsql | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-process | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-pspell | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-recode | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-snmp | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-soap | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-tidy | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-xml | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php72-xmlrpc | 7.2.26-1.19.amzn1 |
| amazon linux 1 | php73 | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-bcmath | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-cli | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-common | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-dba | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-dbg | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-debuginfo | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-devel | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-embedded | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-enchant | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-fpm | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-gd | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-gmp | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-imap | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-intl | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-json | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-ldap | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-mbstring | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-mysqlnd | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-odbc | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-opcache | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-pdo | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-pdo-dblib | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-pgsql | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-process | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-pspell | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-recode | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-snmp | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-soap | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-tidy | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-xml | 7.3.13-1.22.amzn1 |
| amazon linux 1 | php73-xmlrpc | 7.3.13-1.22.amzn1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2019-11049
- https://bugs.php.net/bug.php?id=78943
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11049
- https://seclists.org/bugtraq/2020/Feb/27
- https://security.netapp.com/advisory/ntap-20200103-0002/
- https://www.cve.org/CVERecord?id=CVE-2019-11049