Vulnerabilities

CVSS

8.7 High

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Risk score

100.0

Known exploited

CISA KEV

Published

2019-10-28

Status

Published

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Weaknesses

CWE-120

Coverage 1

threat-intel

All-Line Equipment Company Fuel-Boss

A vulnerability exists in All-Line Equipment Company's Fuel-Boss industrial control system software, specifically versions up to and including PHP 7.1.5. Exploitation could allow remote code execution by injecting a mali…

CISA Advisories · 3d ago High

CVE-2018-19518CVE-2019-11043industrial control systemscve-2018-19518cve-2019-11043

All articles mentioning it

Advisories and references

• github.com/neex/phuip-fpizdam
• bugs.php.net/bug.php?id=78599
• usn.ubuntu.com/4166-1/
• debian.org/security/2019/dsa-4552
• debian.org/security/2019/dsa-4553
• usn.ubuntu.com/4166-2/
• support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_...
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedor...
• security.netapp.com/advisory/ntap-20191031-0003/
• access.redhat.com/errata/RHSA-2019:3286