High severity8.7CISA KEVNVD Advisory· Published Oct 28, 2019· Updated Jun 17, 2026

CVE-2019-11043

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

102

PHP/PHP3 versions
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: >=7.1.0,<7.1.33
- (no CPE)range: >=7.1.0,<7.1.33 || >=7.2.0,<7.2.24 || >=7.3.0,<7.3.11
- (no CPE)range: 7.1.x
Red Hat/Software Collections
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
Tenable/Tenable.sc
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*
Range: <5.19.0
Canonical/Ubuntu Linux6 versions
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*+ 5 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora3 versions
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server3 versions
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Desktop2 versions
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus6 versions
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus Compute Node
cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.7:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Arm 64
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Ibm Z Systems Eus11 versions
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.1_aarch64:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.1_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.2_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.4_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Ibm Z Systems3 versions
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Big Endian2 versions
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Big Endian Eus
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Little Endian2 versions
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Little Endian Eus6 versions
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Scientific Computing
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus4 versions
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Tus5 versions
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation2 versions
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
osv-coords36 versions
pkg:rpm/almalinux/apcu-panel pkg:rpm/almalinux/libzip pkg:rpm/almalinux/libzip-devel pkg:rpm/almalinux/libzip-tools pkg:rpm/almalinux/php-pear pkg:rpm/almalinux/php-pecl-apcu pkg:rpm/almalinux/php-pecl-apcu-devel pkg:rpm/almalinux/php-pecl-zip pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/php7-test&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/php7-test&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php7&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5
< 5.1.12-2.module_el8.3.0+2010+7c76a223+ 35 more
- (no CPE)range: < 5.1.12-2.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 1.5.1-2.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 1.5.1-2.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 1.5.1-2.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 1:1.10.5-9.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 5.1.12-2.module_el8.5.0+53+9945c2af
- (no CPE)range: < 5.1.12-2.module_el8.5.0+53+9945c2af
- (no CPE)range: < 1.15.3-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.5-lp150.2.29.2
- (no CPE)range: < 7.2.5-lp151.6.13.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.4.24-1.1
- (no CPE)range: < 7.2.5-lp150.2.29.2
- (no CPE)range: < 7.2.5-lp151.6.13.1
- (no CPE)range: < 8.0.11-1.1
- (no CPE)range: < 5.5.14-109.68.1
- (no CPE)range: < 5.5.14-109.68.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.5-4.46.1
- (no CPE)range: < 7.0.7-50.88.1
- (no CPE)range: < 7.2.5-4.46.1
- (no CPE)range: < 7.2.5-4.46.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.0.7-50.88.1
- (no CPE)range: < 7.0.7-50.88.1
- (no CPE)range: < 7.2.5-1.29.1
- (no CPE)range: < 7.2.5-1.29.1
- (no CPE)range: < 7.2.5-1.29.1

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
bugs.php.net/bug.phpnvdExploitIssue TrackingPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.htmlnvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2020/Jan/40nvdMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2019:3286nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:3287nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:3299nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:3300nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:3724nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:3735nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:3736nvdThird Party Advisory
access.redhat.com/errata/RHSA-2020:0322nvdThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/nvdMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/nvdMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2020/Jan/44nvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20191031-0003/nvdThird Party Advisory
support.apple.com/kb/HT210919nvdThird Party Advisory
support.f5.com/csp/article/K75408500nvdThird Party Advisory
usn.ubuntu.com/4166-1/nvdThird Party Advisory
usn.ubuntu.com/4166-2/nvdThird Party Advisory
www.debian.org/security/2019/dsa-4552nvdMailing ListThird Party Advisory
www.debian.org/security/2019/dsa-4553nvdMailing ListThird Party Advisory
www.synology.com/security/advisory/Synology_SA_19_36nvdThird Party Advisory
www.tenable.com/security/tns-2021-14nvdThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.565
epss	0.080
exploit	0.030
kev	0.120
patch	-0.070
ransomware	0.060