CVE-2019-11043

HIGHScheduled

Published:Oct 28, 2019(6 years ago)

Modified:Nov 3, 2025

Remote ExploitNo Auth RequiredNo InteractionScope Changes

Vulnerability Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Attack Characteristics

Network AccessHigh ComplexityNo Auth NeededNo User Interaction

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

No Fix Known

No patch has been released yet. Apply workarounds or mitigations where available.

Affected Software

Vendor	Product	Versions	Fixed In
php	php	7.1.0 - 7.1.33	-
php	php	7.2.0 - 7.2.24	-
php	php	7.3.0 - 7.3.11

Timeline

Published
CVE disclosed publicly
Oct 28, 20196 years ago
Last Modified
Most recent update
Nov 3, 20256 months ago
Indexed to CVEInsight
Added to this platform
Mar 29, 20261 month ago

References

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011....Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014....Mailing List
http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Ex...Exploit

CVSS Score

v3.1

8.7/ 10.0

HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

At a Glance

Affected Products

References

php / php +65 more

http://seclists.org/fulldisclosure/2020/Jan/40Mailing List

https://access.redhat.com/errata/RHSA-2019:3286Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3287Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3299Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3300Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3724Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3735Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3736Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0322Third Party Advisory

https://bugs.php.net/bug.php?id=78599Exploit

https://github.com/neex/phuip-fpizdamExploit

https://lists.fedoraproject.org/archives/list/package-announce%40lists...Mailing List

https://seclists.org/bugtraq/2020/Jan/44Mailing List

https://security.netapp.com/advisory/ntap-20191031-0003/Third Party Advisory

https://support.apple.com/kb/HT210919Third Party Advisory

https://support.f5.com/csp/article/K75408500?utm_source=f5support&amp%...Third Party Advisory

https://usn.ubuntu.com/4166-1/Third Party Advisory

https://usn.ubuntu.com/4166-2/Third Party Advisory

https://www.debian.org/security/2019/dsa-4552Mailing List

https://www.debian.org/security/2019/dsa-4553Mailing List

https://www.synology.com/security/advisory/Synology_SA_19_36Third Party Advisory

https://www.tenable.com/security/tns-2021-14Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011....Mailing List

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014....Mailing List

http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Ex...Exploit