The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-php5alpine-linux-upgrade-php7 | Oct 26, 2018 | Sep 16, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade--php70amazon-linux-upgrade--php71amazon-linux-upgrade--php72amazon-linux-upgrade-php56 | Oct 19, 2018 | Sep 16, 2018 |
| Debian | debian-upgrade-php7-3 | Dec 11, 2018 | Sep 16, 2018 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-lang-php | Dec 3, 2018 | Sep 16, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-phphuawei-euleros-2_0_sp2-upgrade-php-clihuawei-euleros-2_0_sp2-upgrade-php-commonhuawei-euleros-2_0_sp2-upgrade-php-gdhuawei-euleros-2_0_sp2-upgrade-php-ldaphuawei-euleros-2_0_sp2-upgrade-php-mysqlhuawei-euleros-2_0_sp2-upgrade-php-odbchuawei-euleros-2_0_sp2-upgrade-php-pdohuawei-euleros-2_0_sp2-upgrade-php-pgsqlhuawei-euleros-2_0_sp2-upgrade-php-processhuawei-euleros-2_0_sp2-upgrade-php-recodehuawei-euleros-2_0_sp2-upgrade-php-soaphuawei-euleros-2_0_sp2-upgrade-php-xmlhuawei-euleros-2_0_sp2-upgrade-php-xmlrpc | Dec 4, 2019 | Sep 16, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-phphuawei-euleros-2_0_sp3-upgrade-php-clihuawei-euleros-2_0_sp3-upgrade-php-commonhuawei-euleros-2_0_sp3-upgrade-php-gdhuawei-euleros-2_0_sp3-upgrade-php-ldaphuawei-euleros-2_0_sp3-upgrade-php-mysqlhuawei-euleros-2_0_sp3-upgrade-php-odbchuawei-euleros-2_0_sp3-upgrade-php-pdohuawei-euleros-2_0_sp3-upgrade-php-pgsqlhuawei-euleros-2_0_sp3-upgrade-php-processhuawei-euleros-2_0_sp3-upgrade-php-recodehuawei-euleros-2_0_sp3-upgrade-php-soaphuawei-euleros-2_0_sp3-upgrade-php-xmlhuawei-euleros-2_0_sp3-upgrade-php-xmlrpc | Dec 18, 2019 | Sep 16, 2018 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-phphuawei-euleros-2_0_sp5-upgrade-php-clihuawei-euleros-2_0_sp5-upgrade-php-commonhuawei-euleros-2_0_sp5-upgrade-php-gdhuawei-euleros-2_0_sp5-upgrade-php-ldaphuawei-euleros-2_0_sp5-upgrade-php-mysqlhuawei-euleros-2_0_sp5-upgrade-php-odbchuawei-euleros-2_0_sp5-upgrade-php-pdohuawei-euleros-2_0_sp5-upgrade-php-pgsqlhuawei-euleros-2_0_sp5-upgrade-php-processhuawei-euleros-2_0_sp5-upgrade-php-recodehuawei-euleros-2_0_sp5-upgrade-php-soaphuawei-euleros-2_0_sp5-upgrade-php-xmlhuawei-euleros-2_0_sp5-upgrade-php-xmlrpc | Sep 24, 2019 | Sep 16, 2018 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-php-56-5-6-39-0-175-3-36-0-19-0oracle-solaris-11-3-upgrade-web-php-71-7-1-25-0-175-3-36-0-19-0oracle-solaris-11-4-upgrade-web-php-56-5-6-38-11-4-3-0-1-3-0oracle-solaris-11-4-upgrade-web-php-71-7-1-22-11-4-3-0-1-3-0 | Nov 19, 2018 | Sep 16, 2018 | |
| Php | php-upgrade-5_6_38php-upgrade-7_0_32php-upgrade-7_1_22php-upgrade-7_2_10 | Nov 12, 2018 | Sep 16, 2018 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Sep 16, 2018 |
| Suse | — | suse-upgrade-apache2-mod_php5suse-upgrade-apache2-mod_php53suse-upgrade-apache2-mod_php7suse-upgrade-php5suse-upgrade-php5-bcmathsuse-upgrade-php5-bz2suse-upgrade-php5-calendarsuse-upgrade-php5-ctypesuse-upgrade-php5-curlsuse-upgrade-php5-dbasuse-upgrade-php5-develsuse-upgrade-php5-domsuse-upgrade-php5-enchantsuse-upgrade-php5-exifsuse-upgrade-php5-fastcgisuse-upgrade-php5-fileinfosuse-upgrade-php5-fpmsuse-upgrade-php5-ftpsuse-upgrade-php5-gdsuse-upgrade-php5-gettextsuse-upgrade-php5-gmpsuse-upgrade-php5-iconvsuse-upgrade-php5-imapsuse-upgrade-php5-intlsuse-upgrade-php5-jsonsuse-upgrade-php5-ldapsuse-upgrade-php5-mbstringsuse-upgrade-php5-mcryptsuse-upgrade-php5-mysqlsuse-upgrade-php5-odbcsuse-upgrade-php5-opcachesuse-upgrade-php5-opensslsuse-upgrade-php5-pcntlsuse-upgrade-php5-pdosuse-upgrade-php5-pearsuse-upgrade-php5-pgsqlsuse-upgrade-php5-pharsuse-upgrade-php5-posixsuse-upgrade-php5-pspellsuse-upgrade-php5-shmopsuse-upgrade-php5-snmpsuse-upgrade-php5-soapsuse-upgrade-php5-socketssuse-upgrade-php5-sqlitesuse-upgrade-php5-suhosinsuse-upgrade-php5-sysvmsgsuse-upgrade-php5-sysvsemsuse-upgrade-php5-sysvshmsuse-upgrade-php5-tokenizersuse-upgrade-php5-wddxsuse-upgrade-php5-xmlreadersuse-upgrade-php5-xmlrpcsuse-upgrade-php5-xmlwritersuse-upgrade-php5-xslsuse-upgrade-php5-zipsuse-upgrade-php5-zlibsuse-upgrade-php53suse-upgrade-php53-bcmathsuse-upgrade-php53-bz2suse-upgrade-php53-calendarsuse-upgrade-php53-ctypesuse-upgrade-php53-curlsuse-upgrade-php53-dbasuse-upgrade-php53-develsuse-upgrade-php53-domsuse-upgrade-php53-exifsuse-upgrade-php53-fastcgisuse-upgrade-php53-fileinfosuse-upgrade-php53-ftpsuse-upgrade-php53-gdsuse-upgrade-php53-gettextsuse-upgrade-php53-gmpsuse-upgrade-php53-iconvsuse-upgrade-php53-imapsuse-upgrade-php53-intlsuse-upgrade-php53-jsonsuse-upgrade-php53-ldapsuse-upgrade-php53-mbstringsuse-upgrade-php53-mcryptsuse-upgrade-php53-mysqlsuse-upgrade-php53-odbcsuse-upgrade-php53-opensslsuse-upgrade-php53-pcntlsuse-upgrade-php53-pdosuse-upgrade-php53-pearsuse-upgrade-php53-pgsqlsuse-upgrade-php53-posixsuse-upgrade-php53-pspellsuse-upgrade-php53-readlinesuse-upgrade-php53-shmopsuse-upgrade-php53-snmpsuse-upgrade-php53-soapsuse-upgrade-php53-socketssuse-upgrade-php53-sqlitesuse-upgrade-php53-suhosinsuse-upgrade-php53-sysvmsgsuse-upgrade-php53-sysvsemsuse-upgrade-php53-sysvshmsuse-upgrade-php53-tidysuse-upgrade-php53-tokenizersuse-upgrade-php53-wddxsuse-upgrade-php53-xmlreadersuse-upgrade-php53-xmlrpcsuse-upgrade-php53-xmlwritersuse-upgrade-php53-xslsuse-upgrade-php53-zipsuse-upgrade-php53-zlibsuse-upgrade-php7suse-upgrade-php7-bcmathsuse-upgrade-php7-bz2suse-upgrade-php7-calendarsuse-upgrade-php7-ctypesuse-upgrade-php7-curlsuse-upgrade-php7-dbasuse-upgrade-php7-develsuse-upgrade-php7-domsuse-upgrade-php7-embedsuse-upgrade-php7-enchantsuse-upgrade-php7-exifsuse-upgrade-php7-fastcgisuse-upgrade-php7-fileinfosuse-upgrade-php7-firebirdsuse-upgrade-php7-fpmsuse-upgrade-php7-ftpsuse-upgrade-php7-gdsuse-upgrade-php7-gettextsuse-upgrade-php7-gmpsuse-upgrade-php7-iconvsuse-upgrade-php7-imapsuse-upgrade-php7-intlsuse-upgrade-php7-jsonsuse-upgrade-php7-ldapsuse-upgrade-php7-mbstringsuse-upgrade-php7-mcryptsuse-upgrade-php7-mysqlsuse-upgrade-php7-odbcsuse-upgrade-php7-opcachesuse-upgrade-php7-opensslsuse-upgrade-php7-pcntlsuse-upgrade-php7-pdosuse-upgrade-php7-pearsuse-upgrade-php7-pear-archive_tarsuse-upgrade-php7-pgsqlsuse-upgrade-php7-pharsuse-upgrade-php7-posixsuse-upgrade-php7-pspellsuse-upgrade-php7-readlinesuse-upgrade-php7-shmopsuse-upgrade-php7-snmpsuse-upgrade-php7-soapsuse-upgrade-php7-socketssuse-upgrade-php7-sodiumsuse-upgrade-php7-sqlitesuse-upgrade-php7-sysvmsgsuse-upgrade-php7-sysvsemsuse-upgrade-php7-sysvshmsuse-upgrade-php7-tidysuse-upgrade-php7-tokenizersuse-upgrade-php7-wddxsuse-upgrade-php7-xmlreadersuse-upgrade-php7-xmlrpcsuse-upgrade-php7-xmlwritersuse-upgrade-php7-xslsuse-upgrade-php7-zipsuse-upgrade-php7-zlibsuse-upgrade-php72-devel | Sep 27, 2018 | Sep 16, 2018 |
| Ubuntu | ubuntu-upgrade-php5ubuntu-upgrade-php7-0ubuntu-upgrade-php7-2 | Nov 19, 2024 | Sep 16, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub