critical
CVE-2019-11043
php: underflow in env_path_info in fpm_main.c
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Red Hat, AlmaLinux, Amazon, Oracle, Rocky Linux. Rated lower by Ubuntu (medium).
Description
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | php:7.2::apcu-panel, php:7.2::libzip, php:7.2::libzip-devel and 13 more | 5.1.12-2.module_el8.3.0+2010+7c76a223 and 7 more |
| amazon linux 1 | php56, php56-bcmath, php56-cli and 126 more | 5.6.40-1.143.amzn1 and 3 more |
| amazon linux 2 | php, php-bcmath, php-cli and 22 more | 5.4.16-46.amzn2.0.2 |
| Oracle Linux 6 | php, php-bcmath, php-cli and 24 more | 5.3.3-50.el6_10 |
| Oracle Linux 7 | php, php-bcmath, php-cli and 22 more | 5.4.16-46.1.el7_7 |
| Oracle Linux 8 | apcu-panel, libzip, libzip-devel and 32 more | 5.1.17-1.module+el8.1.0+5441+020cccf5 and 4 more |
| rocky 8 | php:7.2::apcu-panel, php:7.2::libzip, php:7.2::libzip-devel and 13 more | 5.1.12-2.module+el8.4.0+413+c9202dda and 7 more |
| alpine 3.10 | php7 | 7.3.11-r0 |
| alpine 3.11 | php7 | 7.3.11-r0 |
| alpine 3.12 | php7 | 7.3.11-r0 |
| alpine 3.13 | php7 | 7.3.11-r0 |
| alpine 3.14 | php7 | 7.3.11-r0 |
Show all 292 entries from 26 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | php:7.2::apcu-panel | 5.1.12-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::libzip | 1.5.1-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::libzip-devel | 1.5.1-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::libzip-tools | 1.5.1-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pear | 1:1.10.5-9.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pecl-apcu | 5.1.12-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pecl-apcu-devel | 5.1.12-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pecl-zip | 1.15.3-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.3::apcu-panel | 5.1.17-1.module_el8.3.0+2009+b272fdef |
| alma 8 | php:7.3::libzip | 1.5.2-1.module_el8.3.0+2009+b272fdef |
| alma 8 | php:7.3::libzip-devel | 1.5.2-1.module_el8.3.0+2009+b272fdef |
| alma 8 | php:7.3::libzip-tools | 1.5.2-1.module_el8.3.0+2009+b272fdef |
| alma 8 | php:7.3::php-pear | 1:1.10.9-1.module_el8.3.0+2009+b272fdef |
| alma 8 | php:7.3::php-pecl-apcu | 5.1.17-1.module_el8.3.0+2009+b272fdef |
| alma 8 | php:7.3::php-pecl-apcu-devel | 5.1.17-1.module_el8.3.0+2009+b272fdef |
| alma 8 | php:7.3::php-pecl-zip | 1.15.4-1.module_el8.3.0+2009+b272fdef |
| amazon linux 1 | php56 | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-bcmath | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-cli | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-common | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-dba | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-dbg | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-debuginfo | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-devel | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-embedded | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-enchant | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-fpm | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-gd | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-gmp | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-imap | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-intl | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-ldap | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-mbstring | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-mcrypt | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-mssql | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-mysqlnd | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-odbc | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-opcache | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-pdo | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-pgsql | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-process | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-pspell | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-recode | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-snmp | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-soap | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-tidy | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-xml | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php56-xmlrpc | 5.6.40-1.143.amzn1 |
| amazon linux 1 | php71 | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-bcmath | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-cli | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-common | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-dba | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-dbg | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-debuginfo | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-devel | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-embedded | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-enchant | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-fpm | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-gd | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-gmp | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-imap | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-intl | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-json | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-ldap | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-mbstring | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-mcrypt | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-mysqlnd | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-odbc | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-opcache | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-pdo | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-pdo-dblib | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-pgsql | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-process | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-pspell | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-recode | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-snmp | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-soap | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-tidy | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-xml | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php71-xmlrpc | 7.1.33-1.43.amzn1 |
| amazon linux 1 | php72 | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-bcmath | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-cli | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-common | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-dba | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-dbg | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-debuginfo | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-devel | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-embedded | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-enchant | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-fpm | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-gd | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-gmp | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-imap | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-intl | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-json | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-ldap | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-mbstring | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-mysqlnd | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-odbc | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-opcache | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-pdo | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-pdo-dblib | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-pgsql | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-process | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-pspell | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-recode | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-snmp | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-soap | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-tidy | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-xml | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php72-xmlrpc | 7.2.24-1.18.amzn1 |
| amazon linux 1 | php73 | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-bcmath | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-cli | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-common | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-dba | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-dbg | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-debuginfo | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-devel | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-embedded | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-enchant | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-fpm | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-gd | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-gmp | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-imap | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-intl | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-json | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-ldap | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-mbstring | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-mysqlnd | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-odbc | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-opcache | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-pdo | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-pdo-dblib | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-pgsql | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-process | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-pspell | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-recode | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-snmp | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-soap | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-tidy | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-xml | 7.3.11-1.21.amzn1 |
| amazon linux 1 | php73-xmlrpc | 7.3.11-1.21.amzn1 |
| amazon linux 2 | php | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-bcmath | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-cli | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-common | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-dba | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-debuginfo | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-devel | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-embedded | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-enchant | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-fpm | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-gd | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-intl | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-ldap | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-mbstring | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-mysqlnd | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-odbc | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-pdo | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-pgsql | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-process | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-pspell | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-recode | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-snmp | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-soap | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-xml | 5.4.16-46.amzn2.0.2 |
| amazon linux 2 | php-xmlrpc | 5.4.16-46.amzn2.0.2 |
| Oracle Linux 6 | php | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-bcmath | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-cli | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-common | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-dba | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-devel | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-embedded | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-enchant | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-fpm | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-gd | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-imap | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-intl | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-ldap | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-mbstring | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-mysql | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-odbc | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-pdo | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-pgsql | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-process | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-pspell | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-recode | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-snmp | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-soap | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-tidy | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-xml | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-xmlrpc | 5.3.3-50.el6_10 |
| Oracle Linux 6 | php-zts | 5.3.3-50.el6_10 |
| Oracle Linux 7 | php | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-bcmath | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-cli | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-common | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-dba | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-devel | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-embedded | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-enchant | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-fpm | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-gd | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-intl | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-ldap | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-mbstring | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-mysql | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-mysqlnd | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-odbc | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-pdo | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-pgsql | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-process | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-pspell | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-recode | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-snmp | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-soap | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-xml | 5.4.16-46.1.el7_7 |
| Oracle Linux 7 | php-xmlrpc | 5.4.16-46.1.el7_7 |
| Oracle Linux 8 | apcu-panel | 5.1.17-1.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | libzip | 1.5.2-1.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | libzip-devel | 1.5.2-1.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | libzip-tools | 1.5.2-1.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-bcmath | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-cli | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-common | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-dba | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-dbg | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-devel | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-embedded | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-enchant | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-fpm | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-gd | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-gmp | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-intl | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-json | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-ldap | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-mbstring | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-mysqlnd | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-odbc | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-opcache | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-pdo | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-pear | 1:1.10.9-1.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-pecl-apcu | 5.1.17-1.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-pecl-apcu-devel | 5.1.17-1.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-pecl-zip | 1.15.4-1.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-pgsql | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-process | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-recode | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-snmp | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-soap | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-xml | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| Oracle Linux 8 | php-xmlrpc | 7.3.5-5.module+el8.1.0+5441+020cccf5 |
| rocky 8 | php:7.2::apcu-panel | 5.1.12-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::libzip | 1.5.1-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::libzip-devel | 1.5.1-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::libzip-tools | 1.5.1-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pear | 1:1.10.5-9.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pecl-apcu | 5.1.12-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pecl-apcu-devel | 5.1.12-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pecl-zip | 1.15.3-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.3::apcu-panel | 5.1.17-1.module+el8.4.0+414+2e7afcdd |
| rocky 8 | php:7.3::libzip | 1.5.2-1.module+el8.4.0+414+2e7afcdd |
| rocky 8 | php:7.3::libzip-devel | 1.5.2-1.module+el8.4.0+414+2e7afcdd |
| rocky 8 | php:7.3::libzip-tools | 1.5.2-1.module+el8.4.0+414+2e7afcdd |
| rocky 8 | php:7.3::php-pear | 1:1.10.9-1.module+el8.4.0+414+2e7afcdd |
| rocky 8 | php:7.3::php-pecl-apcu | 5.1.17-1.module+el8.4.0+414+2e7afcdd |
| rocky 8 | php:7.3::php-pecl-apcu-devel | 5.1.17-1.module+el8.4.0+414+2e7afcdd |
| rocky 8 | php:7.3::php-pecl-zip | 1.15.4-1.module+el8.4.0+414+2e7afcdd |
| alpine 3.10 | php7 | 7.3.11-r0 |
| alpine 3.11 | php7 | 7.3.11-r0 |
| alpine 3.12 | php7 | 7.3.11-r0 |
| alpine 3.13 | php7 | 7.3.11-r0 |
| alpine 3.14 | php7 | 7.3.11-r0 |
| alpine 3.15 | php7 | 7.3.11-r0 |
| alpine 3.7 | php7 | 7.1.33-r0 |
| alpine 3.8 | php7 | 7.2.24-r0 |
| alpine 3.9 | php7 | 7.2.24-r0 |
| debian 10 | php7.3 | 7.3.11-1~deb10u1 |
| debian 8 | php5 | 5.6.40+dfsg-0+deb8u7 |
| debian 9 | php7.0 | 7.0.33-0+deb9u6 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.29+esm6 |
| ubuntu 16.04 | php7.0 | 7.0.33-0ubuntu0.16.04.7 |
| ubuntu 16.04-ESM | php7.0 | 7.0.33-0ubuntu0.16.04.7 |
| ubuntu 18.04 | php7.2 | 7.2.24-0ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | php7.2 | 7.2.24-0ubuntu0.18.04.1 |
| ubuntu 19.04 | php7.2 | 7.2.24-0ubuntu0.19.04.1 |
| ubuntu 19.10 | php7.3 | 7.3.11-0ubuntu0.19.10.1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html
- http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/Jan/40
- https://access.redhat.com/errata/RHSA-2019:3286
- https://access.redhat.com/errata/RHSA-2019:3287
- https://access.redhat.com/errata/RHSA-2019:3299
- https://access.redhat.com/errata/RHSA-2019:3300
All 42 references
- https://access.redhat.com/errata/RHSA-2019:3724
- https://access.redhat.com/errata/RHSA-2019:3735
- https://access.redhat.com/errata/RHSA-2019:3736
- https://access.redhat.com/errata/RHSA-2020:0322
- https://access.redhat.com/security/cve/CVE-2019-11043
- https://bugs.php.net/bug.php?id=78599
- https://bugzilla.redhat.com/show_bug.cgi?id=1766378
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11043
- https://errata.almalinux.org/8/ALSA-2019-3736.html
- https://errata.rockylinux.org/RLSA-2019:3736
- https://github.com/neex/phuip-fpizdam
- https://github.com/neex/phuip-fpizdam/
- https://linux.oracle.com/cve/CVE-2019-11043.html
- https://linux.oracle.com/errata/ELSA-2019-3736.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11043
- https://seclists.org/bugtraq/2020/Jan/44
- https://security.netapp.com/advisory/ntap-20191031-0003/
- https://support.apple.com/kb/HT210919
- https://support.f5.com/csp/article/K75408500?utm_source=f5support&%3Butm_medium=RSS
- https://ubuntu.com/security/notices/USN-4166-1
- https://ubuntu.com/security/notices/USN-4166-2
- https://usn.ubuntu.com/4166-1/
- https://usn.ubuntu.com/4166-2/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043
- https://www.cve.org/CVERecord?id=CVE-2019-11043
- https://www.debian.org/security/2019/dsa-4552
- https://www.debian.org/security/2019/dsa-4553
- https://www.nginx.com/blog/php-fpm-cve-2019-11043-vulnerability-nginx/
- https://www.synology.com/security/advisory/Synology_SA_19_36
- https://www.tenable.com/security/tns-2021-14