CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

CVSS: 9.8v3.1CriticalKEVRansomwareAnalyzed

AliasesMGASA-2019-0307SUSE-SU-2019:2809-1SUSE-SU-2019:2819-1+17 more

Published 28-10-2019Last modified 21-10-2025

Vulnerability summary

CVE-2019-11043 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in PHP FastCGI Process Manager (FPM). It is known to be exploited: CISA lists it, first on 25-03-2022. It has been used in ransomware campaigns. EPSS estimates a 99.75% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 6 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

99.75%

0%100%

Critical · -0.03 pp in 30 days

KEVListedCISA

RansomwareKnown useFlagged by CISA

Public exploits6github, reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 5 · Related 4

OPENSUSE-SU-2024:11167-1 OPENSUSE-SU-2024:11169-1 RHSA-2019:3299 SUSE-SU-2020:0522-1 SUSE-SU-2022:4067-1

Timeline

28-10-2019
PublishedVulnerability first disclosed.
25-03-2022
Added to CISA KEVPHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
15-04-2022
CISA remediation dueApply updates per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVSS metrics

5 scores · 4 sources · 3 versions

v3.19.8v3.08.1v2.07.5

EPSS trend

Probability

99.75%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.03 pp

From 99.78% on 20-09-2026

20-09-202620-10-2026

EPSS score

99.75%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 25-03-2022
Federal due date: 15-04-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-11043

Public exploits

6 found

githubUnverified
Phuip Fpizdam
Maturity: poc
referenceUnverified
Exploit Reference (bugs.php.net)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 6 exploits

exploit-databaseremotephpVerified
PHP-FPM - Underflow Remote Code Execution (Metasploit)
Maturity: weaponized
exploit-databasephpUnverified
PHP-FPM + Nginx - Remote Code Execution
Maturity: poc
MetasploitremoteUnverified
PHP-FPM Underflow RCE
exploit/multi/http/php_fpm_rce
Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Redhat154 products

enterprise_linux8.0
enterprise_linux_desktop6.0 | 7.0
enterprise_linux_eus7.7 | 8.1 | 8.2 | 8.4 | 8.6 | 8.8
enterprise_linux_eus_compute_node7.7
enterprise_linux_for_arm_648.0_aarch64

enterprise_linux_for_arm_64_eus8.1_aarch64 | 8.2_aarch64 | 8.4_aarch64 | 8.6_aarch64 | 8.8_aarch64
enterprise_linux_for_ibm_z_systems6.0_s390x | 7.0_s390x | 8.0_s390x
enterprise_linux_for_ibm_z_systems_eus7.7_s390x | 8.1_s390x | 8.2_s390x | 8.4_s390x | 8.6_s390x | 8.8_s390x
enterprise_linux_for_power_big_endian6.0_ppc64 | 7.0_ppc64
enterprise_linux_for_power_big_endian_eus7.7_ppc64
enterprise_linux_for_power_little_endian7.0_ppc64le | 8.0_ppc64le
enterprise_linux_for_power_little_endian_eus7.7_ppc64le | 8.1_ppc64le | 8.2_ppc64le | 8.4_ppc64le | 8.6_ppc64le | 8.8_ppc64le
enterprise_linux_for_scientific_computing7.0
enterprise_linux_server6.0 | 7.0
enterprise_linux_server_aus7.7 | 8.2 | 8.4 | 8.6
enterprise_linux_server_tus7.7 | 8.2 | 8.4 | 8.6 | 8.8
enterprise_linux_workstation6.0 | 7.0
software_collections1.0
apcu-panel< 0:5.1.12-1.module+el8+2561+1aca3413 | < 0:5.1.12-2.module+el8.1.0+3202+af5476b9 | < 0:5.1.17-1.module+el8.1.0+3189+a1bff096
libzip< 0:1.5.1-1.module+el8+2561+1aca3413 | < 0:1.5.1-2.module+el8.1.0+3202+af5476b9 | < 0:1.5.2-1.module+el8.1.0+3189+a1bff096
libzip-debuginfo< 0:1.5.1-1.module+el8+2561+1aca3413 | < 0:1.5.1-2.module+el8.1.0+3202+af5476b9 | < 0:1.5.2-1.module+el8.1.0+3189+a1bff096
libzip-debugsource< 0:1.5.1-1.module+el8+2561+1aca3413 | < 0:1.5.1-2.module+el8.1.0+3202+af5476b9 | < 0:1.5.2-1.module+el8.1.0+3189+a1bff096
libzip-devel< 0:1.5.1-1.module+el8+2561+1aca3413 | < 0:1.5.1-2.module+el8.1.0+3202+af5476b9 | < 0:1.5.2-1.module+el8.1.0+3189+a1bff096
libzip-tools< 0:1.5.1-1.module+el8+2561+1aca3413 | < 0:1.5.1-2.module+el8.1.0+3202+af5476b9 | < 0:1.5.2-1.module+el8.1.0+3189+a1bff096
libzip-tools-debuginfo< 0:1.5.1-1.module+el8+2561+1aca3413 | < 0:1.5.1-2.module+el8.1.0+3202+af5476b9 | < 0:1.5.2-1.module+el8.1.0+3189+a1bff096
php< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-bcmath< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-bcmath-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-cli< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-cli-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-common< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-common-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-dba< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-dba-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-dbg< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-dbg-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-debugsource< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-devel< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-embedded< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-embedded-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-enchant< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-enchant-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-fpm< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-fpm-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-gd< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-gd-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-gmp< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-gmp-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-imap< 0:5.3.3-50.el6_10
php-intl< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-intl-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-json< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-json-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-ldap< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-ldap-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-mbstring< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-mbstring-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-mysql< 0:5.4.16-46.1.el7_6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-mysqlnd< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7
php-mysqlnd-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-odbc< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-odbc-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-opcache< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-opcache-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-pdo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-pdo-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-pear< 1:1.10.5-8.module+el8+2561+1aca3413 | < 1:1.10.5-9.module+el8.1.0+3202+af5476b9 | < 1:1.10.9-1.module+el8.1.0+3189+a1bff096
php-pecl-apcu< 0:5.1.12-1.module+el8+2561+1aca3413 | < 0:5.1.12-2.module+el8.1.0+3202+af5476b9 | < 0:5.1.17-1.module+el8.1.0+3189+a1bff096
php-pecl-apcu-debuginfo< 0:5.1.12-1.module+el8+2561+1aca3413 | < 0:5.1.12-2.module+el8.1.0+3202+af5476b9 | < 0:5.1.17-1.module+el8.1.0+3189+a1bff096
php-pecl-apcu-debugsource< 0:5.1.12-1.module+el8+2561+1aca3413 | < 0:5.1.12-2.module+el8.1.0+3202+af5476b9 | < 0:5.1.17-1.module+el8.1.0+3189+a1bff096
php-pecl-apcu-devel< 0:5.1.12-1.module+el8+2561+1aca3413 | < 0:5.1.12-2.module+el8.1.0+3202+af5476b9 | < 0:5.1.17-1.module+el8.1.0+3189+a1bff096
php-pecl-zip< 0:1.15.3-1.module+el8+2561+1aca3413 | < 0:1.15.3-1.module+el8.1.0+3186+20164e6f | < 0:1.15.4-1.module+el8.1.0+3189+a1bff096
php-pecl-zip-debuginfo< 0:1.15.3-1.module+el8+2561+1aca3413 | < 0:1.15.3-1.module+el8.1.0+3186+20164e6f | < 0:1.15.4-1.module+el8.1.0+3189+a1bff096
php-pecl-zip-debugsource< 0:1.15.3-1.module+el8+2561+1aca3413 | < 0:1.15.3-1.module+el8.1.0+3186+20164e6f | < 0:1.15.4-1.module+el8.1.0+3189+a1bff096
php-pgsql< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-pgsql-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-process< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-process-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-pspell< 0:5.4.16-46.1.el7_6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-recode< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-recode-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-snmp< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-snmp-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-soap< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-soap-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-tidy< 0:5.3.3-50.el6_10
php-xml< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-xml-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-xmlrpc< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:5.4.16-46.1.el7_6 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6 | < 0:5.4.16-46.1.el7_7 | < 0:5.3.3-50.el6_10
php-xmlrpc-debuginfo< 0:7.2.11-1.1.module+el8.0.0+4664+17bd8d65 | < 0:7.2.11-4.module+el8.1.0+4555+f5cb8e18 | < 0:7.3.5-5.module+el8.1.0+4560+e0eee7d6
php-zts< 0:5.3.3-50.el6_10
rh-php70-php< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-bcmath< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-cli< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-common< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-dba< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-dbg< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-debuginfo< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-devel< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-embedded< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-enchant< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-fpm< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-gd< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-gmp< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-imap< 0:7.0.27-2.el6
rh-php70-php-intl< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-json< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-ldap< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-mbstring< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-mysqlnd< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-odbc< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-opcache< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-pdo< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-pgsql< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-process< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-pspell< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-recode< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-snmp< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-soap< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-tidy< 0:7.0.27-2.el6
rh-php70-php-xml< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-xmlrpc< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php70-php-zip< 0:7.0.27-2.el6 | < 0:7.0.27-2.el7
rh-php71-php< 0:7.1.30-2.el7
rh-php71-php-bcmath< 0:7.1.30-2.el7
rh-php71-php-cli< 0:7.1.30-2.el7
rh-php71-php-common< 0:7.1.30-2.el7
rh-php71-php-dba< 0:7.1.30-2.el7
rh-php71-php-dbg< 0:7.1.30-2.el7
rh-php71-php-debuginfo< 0:7.1.30-2.el7
rh-php71-php-devel< 0:7.1.30-2.el7
rh-php71-php-embedded< 0:7.1.30-2.el7
rh-php71-php-enchant< 0:7.1.30-2.el7
rh-php71-php-fpm< 0:7.1.30-2.el7
rh-php71-php-gd< 0:7.1.30-2.el7
rh-php71-php-gmp< 0:7.1.30-2.el7
rh-php71-php-intl< 0:7.1.30-2.el7
rh-php71-php-json< 0:7.1.30-2.el7
rh-php71-php-ldap< 0:7.1.30-2.el7
rh-php71-php-mbstring< 0:7.1.30-2.el7
rh-php71-php-mysqlnd< 0:7.1.30-2.el7
rh-php71-php-odbc< 0:7.1.30-2.el7
rh-php71-php-opcache< 0:7.1.30-2.el7
rh-php71-php-pdo< 0:7.1.30-2.el7
rh-php71-php-pgsql< 0:7.1.30-2.el7
rh-php71-php-process< 0:7.1.30-2.el7
rh-php71-php-pspell< 0:7.1.30-2.el7
rh-php71-php-recode< 0:7.1.30-2.el7
rh-php71-php-snmp< 0:7.1.30-2.el7
rh-php71-php-soap< 0:7.1.30-2.el7
rh-php71-php-xml< 0:7.1.30-2.el7
rh-php71-php-xmlrpc< 0:7.1.30-2.el7
rh-php71-php-zip< 0:7.1.30-2.el7

Show all 154

Suse9 products

php72&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 7.2.5-1.29.1
php72&distro=SUSE Linux Enterprise Software Development Kit 12 SP4< 7.2.5-1.29.1
php72&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 7.2.5-1.29.1
php7&distro=SUSE Linux Enterprise Module for Package Hub 15< 7.2.5-4.46.1
php7&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 7.0.7-50.88.1

Show all 9

Debian4 products

php5< 5.6.40+dfsg-0+deb8u7
php7.0< 7.0.33-0+deb9u6
php7.3< 7.3.11-1~deb10u1
debian_linuxEOL9.0 | 10.0

Opensuse4 products

php7-test&distro=openSUSE Leap 15.0< 7.2.5-lp150.2.29.2
php7-test&distro=openSUSE Leap 15.1< 7.2.5-lp151.6.13.1
php7&distro=openSUSE Leap 15.0< 7.2.5-lp150.2.29.2
php7&distro=openSUSE Leap 15.1< 7.2.5-lp151.6.13.1

Ubuntu3 products

php5< 5.5.9+dfsg-1ubuntu4.29+esm6
php7.0< 7.0.33-0ubuntu0.16.04.7
php7.2< 7.2.24-0ubuntu0.18.04.1

Mageia2 products

pcre2< 10.33-1.1.mga7
php< 7.3.11-1.mga7

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.04 | 19.10

Fedoraproject1 product

fedoraEOL29 | 30 | 31

Php1 product

php≥ 7.1.x, < 7.1.33 | ≥ 7.2.x, < 7.2.24 | ≥ 7.3.x, < 7.3.11 | ≥ 7.1.0, < 7.1.33 | ≥ 7.2.0, < 7.2.24 | ≥ 7.3.0, < 7.3.11

Tenable1 product

tenable.sc< 5.19.0

10 vendors · 180 products

References

59 links

github.com/neex/phuip-fpizdamX Refsource MISCExploitThird Party Advisory
bugs.php.net/bug.php?id=78599X Refsource CONFIRMExploitIssue TrackingPatchVendor Advisory
usn.ubuntu.com/4166-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.debian.org/security/2019/dsa-4552Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
www.debian.org/security/2019/dsa-4553Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
usn.ubuntu.com/4166-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_medium=RSSX Refsource CONFIRMThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20191031-0003/X Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2019:3286Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory

Show all 59 references

access.redhat.com/errata/RHSA-2019:3287Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2019:3299Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2019:3300Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2019:3724Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2019:3735Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2019:3736Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
www.synology.com/security/advisory/Synology_SA_19_36X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
support.apple.com/kb/HT210919X Refsource CONFIRMThird Party Advisory
seclists.org/bugtraq/2020/Jan/44Mailing ListX Refsource BUGTRAQThird Party Advisory
seclists.org/fulldisclosure/2020/Jan/40Mailing ListX Refsource FULLDISCThird Party Advisory
access.redhat.com/errata/RHSA-2020:0322Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
www.tenable.com/security/tns-2021-14X Refsource CONFIRMThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043Government ResourceUS Government Resource
advisories.mageia.org/MGASA-2019-0307.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=25603REPORT
www.php.net/ChangeLog-7.phpWEB
bugs.php.net/bug.php?id=78272REPORT
www.suse.com/support/update/announcement/2019/suse-su-20192809-1/Advisory
bugzilla.suse.com/1154999REPORT
www.suse.com/security/cve/CVE-2019-11043WEB
www.suse.com/support/update/announcement/2019/suse-su-20192819-1/Advisory
www.suse.com/support/update/announcement/2019/suse-su-20192909-1/Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1766378REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3286.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-11043REPORT
www.cve.org/CVERecord?id=CVE-2019-11043AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-11043Advisory
www.nginx.com/blog/php-fpm-cve-2019-11043-vulnerability-nginx/ARTICLE
www.cisa.gov/known-exploited-vulnerabilities-catalogARTICLEREPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3287.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3300.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3724.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3735.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3736.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0322.jsonAdvisory
access.redhat.com/errata/RHSA-2020:2835Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2835.jsonAdvisory
ubuntu.com/security/CVE-2019-11043REPORT
github.com/neex/phuip-fpizdam/REPORT
ubuntu.com/security/notices/USN-4166-1Advisory
ubuntu.com/security/notices/USN-4166-2Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities