Skip to content
OpenAdvisories
Critical 1 exploited CVE RLSA-2019:3736 1 CVE

Critical: php:7.3 security update

Published Nov 6, 2019 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
Rocky Linux · 8 libzip 0:1.5.2-1.module+el8.4.0+414+2e7afcdd
Rocky Linux · 8 php-pear 1:1.10.9-1.module+el8.4.0+414+2e7afcdd
Rocky Linux · 8 php-pecl-apcu 0:5.1.17-1.module+el8.4.0+414+2e7afcdd
Rocky Linux · 8 php-pecl-zip 0:1.15.4-1.module+el8.4.0+414+2e7afcdd

Vulnerabilities 1

  • High 8.7
    CVE-2019-11043 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Underflow in PHP-FPM can lead to RCE

    In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibilit…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
    KEV Mar 25, 2022

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1766378