In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
CVSS Details
- CVSS 3.1 Base Score: 8.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libzip-develUpgrade php-pearUpgrade php-pecl-apcuUpgrade libzip-toolsUpgrade libzipUpgrade php-pecl-apcu-develUpgrade php-pecl-zipUpgrade apcu-panel | May 4, 2022 | Oct 28, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Oct 28, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-pdoUpgrade php-soapUpgrade php-gdUpgrade php-enchantUpgrade php-fpmUpgrade php-odbcUpgrade php-xmlUpgrade php-embeddedUpgrade phpUpgrade php-develUpgrade php-intlUpgrade php-ldapUpgrade php-pspellUpgrade php-bcmathUpgrade php-mysqlndUpgrade php-recodeUpgrade php-cliUpgrade php-snmpUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-dbaUpgrade php-processUpgrade php-commonUpgrade php-debuginfoUpgrade php-mbstring | Apr 27, 2020 | Oct 28, 2019 |
| Amazon_linux | — | Upgrade php73Upgrade php71Upgrade php56Upgrade php72 | Nov 2, 2019 | Oct 28, 2019 |
| Apple Osx Apachemodphp | — | Apply Apple macOS Security Update 2020-001 High SierraApply Apple macOS Security Update 2020-001 Mojave | Jan 29, 2020 | Jan 28, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 28, 2019 |
| Centos_linux | — | Upgrade php-process-debuginfoUpgrade php-dbaUpgrade php-snmp-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-processUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-debuginfoUpgrade php-cli-debuginfoUpgrade php-pgsqlUpgrade php-common-debuginfoUpgrade php-commonUpgrade php-dbg-debuginfoUpgrade php-opcache-debuginfoUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade php-snmpUpgrade libzip-debugsourceUpgrade php-dba-debuginfoUpgrade php-ldap-debuginfoUpgrade php-intl-debuginfoUpgrade php-odbcUpgrade php-mysqlUpgrade php-cliUpgrade php-xml-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-mbstringUpgrade php-recode-debuginfoUpgrade php-pgsql-debuginfoUpgrade libzip-develUpgrade php-recodeUpgrade php-ztsUpgrade php-pecl-zip-debuginfoUpgrade php-json-debuginfoUpgrade php-embeddedUpgrade php-debugsourceUpgrade phpUpgrade php-develUpgrade libzip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-bcmathUpgrade php-pspellUpgrade php-tidyUpgrade php-fpm-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-mysqlndUpgrade php-pearUpgrade php-dbgUpgrade php-soapUpgrade php-embedded-debuginfoUpgrade php-jsonUpgrade php-gmpUpgrade apcu-panelUpgrade libzipUpgrade php-fpmUpgrade php-mbstring-debuginfoUpgrade php-pdoUpgrade php-pecl-apcuUpgrade php-gmp-debuginfoUpgrade php-pecl-zipUpgrade php-ldapUpgrade php-pecl-apcu-develUpgrade php-opcacheUpgrade php-pecl-zip-debugsourceUpgrade php-imapUpgrade php-enchant-debuginfoUpgrade php-gd-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-gdUpgrade php-odbc-debuginfoUpgrade php-enchantUpgrade php-xmlUpgrade php-intl | Nov 1, 2019 | Oct 28, 2019 |
| Debian | — | Upgrade php7.3 | Oct 28, 2019 | Oct 28, 2019 |
| Freebsd | — | Upgrade php71Upgrade php73Upgrade php74Upgrade php72 | Nov 7, 2019 | Nov 6, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 28, 2019 | Oct 25, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-odbcUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-mysqlUpgrade php-commonUpgrade php-soapUpgrade php-pgsqlUpgrade php-gdUpgrade php-cliUpgrade php-ldapUpgrade php-recodeUpgrade php-processUpgrade phpUpgrade php-xml | Dec 4, 2019 | Oct 28, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-ldapUpgrade php-xmlUpgrade php-odbcUpgrade php-commonUpgrade phpUpgrade php-pdoUpgrade php-cliUpgrade php-xmlrpcUpgrade php-mysqlUpgrade php-soapUpgrade php-processUpgrade php-recodeUpgrade php-pgsqlUpgrade php-gd | Dec 18, 2019 | Oct 28, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade php-xmlrpcUpgrade php-processUpgrade php-gdUpgrade php-soapUpgrade php-mysqlUpgrade php-recodeUpgrade php-pdoUpgrade php-ldapUpgrade phpUpgrade php-commonUpgrade php-pgsqlUpgrade php-xmlUpgrade php-odbcUpgrade php-cli | Dec 11, 2019 | Oct 28, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-ldapUpgrade php-xmlUpgrade php-fpmUpgrade php-gdUpgrade php-odbcUpgrade php-soapUpgrade phpUpgrade php-cliUpgrade php-recodeUpgrade php-pdoUpgrade php-commonUpgrade php-xmlrpcUpgrade php-process | Nov 28, 2019 | Oct 28, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.11-11.4.16.0.1.3.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.33-11.4.16.0.1.3.0 on Solaris 11.4 | Dec 18, 2019 | Oct 28, 2019 |
| Oracle_linux | — | Upgrade php-processUpgrade php-pearUpgrade php-gdUpgrade php-ztsUpgrade php-snmpUpgrade php-pdoUpgrade php-mysqlndUpgrade php-xmlUpgrade php-embeddedUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-pecl-zipUpgrade php-enchantUpgrade php-fpmUpgrade php-mysqlUpgrade php-develUpgrade php-mbstringUpgrade php-pspellUpgrade libzipUpgrade php-opcacheUpgrade php-cliUpgrade libzip-develUpgrade php-odbcUpgrade php-pgsqlUpgrade php-jsonUpgrade php-bcmathUpgrade php-ldapUpgrade php-commonUpgrade php-dbgUpgrade php-dbaUpgrade php-gmpUpgrade phpUpgrade libzip-toolsUpgrade php-pecl-apcu-develUpgrade php-imapUpgrade php-pecl-apcuUpgrade php-intlUpgrade php-tidyUpgrade php-soapUpgrade apcu-panel | Nov 1, 2019 | Oct 24, 2019 |
| Redhat_linux | — | Upgrade php-snmp-debuginfoUpgrade libzip-debugsourceUpgrade php-json-debuginfoUpgrade php-common-debuginfoUpgrade php-soap-debuginfoUpgrade phpUpgrade php-dbaUpgrade apcu-panelUpgrade php-cliUpgrade php-gmp-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-opcacheUpgrade php-ldap-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-process-debuginfoUpgrade php-intl-debuginfoUpgrade php-mysqlndUpgrade php-cli-debuginfoUpgrade php-dbg-debuginfoUpgrade php-snmpUpgrade php-recode-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-opcache-debuginfoUpgrade php-recodeUpgrade libzip-toolsUpgrade php-fpm-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-processUpgrade php-commonUpgrade php-intlUpgrade libzip-develUpgrade php-debuginfoUpgrade php-pecl-zipUpgrade php-gd-debuginfoUpgrade php-dbgUpgrade php-gdUpgrade php-odbcUpgrade php-bcmathUpgrade libzipUpgrade php-pdoUpgrade php-jsonUpgrade php-pecl-zip-debugsourceUpgrade php-xmlrpcUpgrade php-xml-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pearUpgrade php-xmlrpc-debuginfoUpgrade php-fpmUpgrade php-mysqlUpgrade php-gmpUpgrade php-dba-debuginfoUpgrade php-develUpgrade php-pecl-apcu-develUpgrade php-odbc-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-pgsqlUpgrade php-enchantUpgrade php-mysqlnd-debuginfoUpgrade php-pspellUpgrade php-mbstring-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pdo-debuginfoUpgrade php-mbstringUpgrade php-soapUpgrade php-pecl-zip-debuginfoUpgrade php-debugsourceUpgrade php-xmlUpgrade php-ldapUpgrade php-pecl-apcuUpgrade php-embedded | Nov 1, 2019 | Oct 28, 2019 |
| Rocky_linux | — | Upgrade libzip-develUpgrade php-pecl-apcu-debuginfoUpgrade libzipUpgrade php-pecl-zipUpgrade libzip-debuginfoUpgrade libzip-debugsourceUpgrade libzip-toolsUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-apcu | Mar 12, 2024 | Oct 28, 2019 |
| Suse | — | Upgrade php5-calendarUpgrade php7-iconvUpgrade php5-zlibUpgrade php7-socketsUpgrade php72-socketsUpgrade php72-sysvmsgUpgrade php5-zipUpgrade php72-zlibUpgrade php7-xmlreaderUpgrade php72-posixUpgrade php5-mcryptUpgrade php7-gettextUpgrade php7-snmpUpgrade php5Upgrade php72-enchantUpgrade apache2-mod_php5Upgrade php72-sodiumUpgrade php7-fastcgiUpgrade php72-bcmathUpgrade php7-odbcUpgrade php72-odbcUpgrade php5-ftpUpgrade php7-pdoUpgrade php5-develUpgrade php7-tidyUpgrade php72-tokenizerUpgrade php5-opcacheUpgrade php7-ftpUpgrade php5-dbaUpgrade php5-pgsqlUpgrade php72-tidyUpgrade php72-xmlreaderUpgrade php7Upgrade php7-sqliteUpgrade php7-wddxUpgrade php7-cliUpgrade php7-pgsqlUpgrade php7-mysqlUpgrade php72-calendarUpgrade php72-sysvshmUpgrade php7-domUpgrade php7-zipUpgrade php7-pspellUpgrade php72-readlineUpgrade php5-posixUpgrade php5-xmlwriterUpgrade php7-sodiumUpgrade php7-gmpUpgrade php72-snmpUpgrade php7-tokenizerUpgrade php5-gettextUpgrade php7-sysvsemUpgrade php72-sysvsemUpgrade php5-odbcUpgrade php72-soapUpgrade php72-pspellUpgrade php5-pcntlUpgrade php7-opcacheUpgrade php72-develUpgrade php7-posixUpgrade php7-gdUpgrade php7-xmlwriterUpgrade php72-ctypeUpgrade php72-xmlrpcUpgrade php5-wddxUpgrade php72-ldapUpgrade php7-enchantUpgrade php72-fileinfoUpgrade php72-fastcgiUpgrade php7-soapUpgrade php7-pearUpgrade php5-enchantUpgrade php72-opcacheUpgrade php7-intlUpgrade php72Upgrade php7-curlUpgrade php7-testUpgrade php72-shmopUpgrade php72-domUpgrade php5-tokenizerUpgrade php5-mysqlUpgrade php7-firebirdUpgrade php72-imapUpgrade php5-bz2Upgrade php7-sysvshmUpgrade php72-mbstringUpgrade php5-ctypeUpgrade php5-pharUpgrade php7-bcmathUpgrade php5-curlUpgrade php7-calendarUpgrade php72-pdoUpgrade php5-xmlrpcUpgrade php5-sysvshmUpgrade php7-develUpgrade php72-xslUpgrade apache2-mod_php72Upgrade php7-readlineUpgrade php7-shmopUpgrade php5-xslUpgrade php5-fileinfoUpgrade php72-sqliteUpgrade php5-mbstringUpgrade php72-iconvUpgrade php5-imapUpgrade php7-sysvmsgUpgrade php72-dbaUpgrade php5-sqliteUpgrade php72-gdUpgrade php5-xmlreaderUpgrade php72-fpmUpgrade php5-suhosinUpgrade php72-pearUpgrade php72-gettextUpgrade php7-zlibUpgrade php5-domUpgrade php7-jsonUpgrade php72-wddxUpgrade php5-pearUpgrade php5-pdoUpgrade php5-fpmUpgrade php5-gmpUpgrade php5-intlUpgrade php7-fileinfoUpgrade php5-sysvsemUpgrade php7-ctypeUpgrade php7-fpmUpgrade php5-gdUpgrade php72-mysqlUpgrade php72-jsonUpgrade php7-opensslUpgrade php72-opensslUpgrade php5-sysvmsgUpgrade php5-jsonUpgrade php5-socketsUpgrade php5-soapUpgrade apache2-mod_php7Upgrade php7-mcryptUpgrade php5-ldapUpgrade php7-xslUpgrade php72-intlUpgrade php5-pspellUpgrade php72-ftpUpgrade php5-iconvUpgrade php7-pear-archive_tarUpgrade php7-bz2Upgrade php72-zipUpgrade php7-pharUpgrade php72-gmpUpgrade php7-pcntlUpgrade php7-imapUpgrade php5-exifUpgrade php5-bcmathUpgrade php5-shmopUpgrade php72-pear-archive_tarUpgrade php5-fastcgiUpgrade php72-pharUpgrade php7-exifUpgrade php7-mbstringUpgrade php72-pcntlUpgrade php72-exifUpgrade php7-embedUpgrade php5-snmpUpgrade php7-xmlrpcUpgrade php72-pgsqlUpgrade php7-dbaUpgrade php72-curlUpgrade php7-ldapUpgrade php72-bz2Upgrade php72-xmlwriterUpgrade php5-openssl | Oct 30, 2019 | Oct 28, 2019 |
| Ubuntu | — | Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php7.3-cgiUpgrade php5-cliUpgrade php5-fpmUpgrade php5-cli (Ubuntu Pro)Upgrade libapache2-mod-php7.3Upgrade libapache2-mod-php5Upgrade php5-cgiUpgrade php7.3-fpmUpgrade php7.3-cliUpgrade php7.0-cgiUpgrade libapache2-mod-php7.2Upgrade php7.2-cliUpgrade php7.2-cgiUpgrade php7.0-fpmUpgrade php7.2-fpmUpgrade php5-cgi (Ubuntu Pro)Upgrade php5-fpm (Ubuntu Pro)Upgrade php7.0-cliUpgrade libapache2-mod-php7.0 | Oct 29, 2019 | Oct 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub