ELSA-2019-3286

Опубликовано: 31 окт. 2019

Источник: oracle-oval

Платформа: Oracle Linux 7

Описание

ELSA-2019-3286: php security update (CRITICAL)

[5.4.16-46.1]

fix underflow in env_path_info in fpm_main.c CVE-2019-11043

Обновленные пакеты

Oracle Linux 7

Oracle Linux aarch64

php

5.4.16-46.1.el7_7

php-bcmath

5.4.16-46.1.el7_7

php-cli

5.4.16-46.1.el7_7

php-common

5.4.16-46.1.el7_7

php-dba

5.4.16-46.1.el7_7

php-devel

5.4.16-46.1.el7_7

php-embedded

5.4.16-46.1.el7_7

php-enchant

5.4.16-46.1.el7_7

php-fpm

5.4.16-46.1.el7_7

php-gd

5.4.16-46.1.el7_7

php-intl

5.4.16-46.1.el7_7

php-ldap

5.4.16-46.1.el7_7

php-mbstring

5.4.16-46.1.el7_7

php-mysql

5.4.16-46.1.el7_7

php-mysqlnd

5.4.16-46.1.el7_7

php-odbc

5.4.16-46.1.el7_7

php-pdo

5.4.16-46.1.el7_7

php-pgsql

5.4.16-46.1.el7_7

php-process

5.4.16-46.1.el7_7

php-pspell

5.4.16-46.1.el7_7

php-recode

5.4.16-46.1.el7_7

php-snmp

5.4.16-46.1.el7_7

php-soap

5.4.16-46.1.el7_7

php-xml

5.4.16-46.1.el7_7

php-xmlrpc

5.4.16-46.1.el7_7

Oracle Linux x86_64

php

5.4.16-46.1.el7_7

php-bcmath

5.4.16-46.1.el7_7

php-cli

5.4.16-46.1.el7_7

php-common

5.4.16-46.1.el7_7

php-dba

5.4.16-46.1.el7_7

php-devel

5.4.16-46.1.el7_7

php-embedded

5.4.16-46.1.el7_7

php-enchant

5.4.16-46.1.el7_7

php-fpm

5.4.16-46.1.el7_7

php-gd

5.4.16-46.1.el7_7

php-intl

5.4.16-46.1.el7_7

php-ldap

5.4.16-46.1.el7_7

php-mbstring

5.4.16-46.1.el7_7

php-mysql

5.4.16-46.1.el7_7

php-mysqlnd

5.4.16-46.1.el7_7

php-odbc

5.4.16-46.1.el7_7

php-pdo

5.4.16-46.1.el7_7

php-pgsql

5.4.16-46.1.el7_7

php-process

5.4.16-46.1.el7_7

php-pspell

5.4.16-46.1.el7_7

php-recode

5.4.16-46.1.el7_7

php-snmp

5.4.16-46.1.el7_7

php-soap

5.4.16-46.1.el7_7

php-xml

5.4.16-46.1.el7_7

php-xmlrpc

5.4.16-46.1.el7_7

Связанные CVE

CVE-2019-11043

Ссылки на источники

Связанные уязвимости

CVE-2019-11043

CVSS3: 8.7

ubuntu

больше 5 лет назад

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.