Skip to content
OpenAdvisories
High 1 exploited CVE USN-4166-1 1 CVE

php7.0, php7.2, php7.3 vulnerability

Published Oct 28, 2019 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PHP incorrectly handled certain paths when being
used in FastCGI configurations. A remote attacker could possibly use this
issue to execute arbitrary code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS php7.0 7.0.33-0ubuntu0.16.04.7
Ubuntu · 18.04 LTS 18.04:LTS php7.2 7.2.24-0ubuntu0.18.04.1

Vulnerabilities 1

  • High 8.7
    CVE-2019-11043 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Underflow in PHP-FPM can lead to RCE

    In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibilit…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
    KEV Mar 25, 2022

References

  • report
    https://ubuntu.com/security/CVE-2019-11043