Skip to content
OpenAdvisories
Critical 1 exploited CVE ELSA-2019-3286 1 CVE

Critical: php security update (Oracle Linux 7)

Published Oct 31, 2019 · Updated Oct 31, 2019

Ecosystem: Oracle Linux

Summary

[5.4.16-46.1]
- fix underflow in env_path_info in fpm_main.c CVE-2019-11043

Fixed packages 25

ReleasePackageFixed in
Oracle Linux · 7 php 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-bcmath 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-cli 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-common 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-dba 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-devel 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-embedded 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-enchant 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-fpm 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-gd 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-intl 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-ldap 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-mbstring 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-mysql 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-mysqlnd 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-odbc 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-pdo 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-pgsql 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-process 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-pspell 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-recode 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-snmp 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-soap 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-xml 0:5.4.16-46.1.el7_7
Oracle Linux · 7 php-xmlrpc 0:5.4.16-46.1.el7_7

Vulnerabilities 1

  • High 8.7
    CVE-2019-11043 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Underflow in PHP-FPM can lead to RCE

    In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibilit…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
    KEV Mar 25, 2022