CVE-2019-11049

In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
phpphp
7.3.0 ≤
𝑥
≤ 7.3.13
phpphp
7.4.0
debiandebian_linux
10.0
tenablesecuritycenter
𝑥
< 5.19.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
bionic
dne
disco
dne
eoan
dne
trusty
not-affected
xenial
dne
php7.0
bionic
dne
disco
dne
eoan
dne
trusty
dne
xenial
not-affected
php7.2
bionic
not-affected
disco
not-affected
eoan
dne
trusty
dne
xenial
dne
php7.3
bionic
dne
disco
dne
eoan
not-affected
trusty
dne
xenial
dne
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
php72
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-bcmath
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-cli
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-common
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-dba
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-dbg
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-debuginfo
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-devel
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-embedded
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-enchant
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-fpm
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-gd
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-gmp
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-imap
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-intl
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-json
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-ldap
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-mbstring
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-mysqlnd
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-odbc
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-opcache
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-pdo
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-pdo-dblib
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-pgsql
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-process
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-pspell
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-recode
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-snmp
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-soap
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-tidy
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-xml
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-xmlrpc
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php73
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-bcmath
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-cli
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-common
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-dba
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-dbg
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-debuginfo
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-devel
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-embedded
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-enchant
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-fpm
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-gd
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-gmp
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-imap
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-intl
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-json
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-ldap
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-mbstring
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-mysqlnd
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-odbc
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-opcache
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-pdo
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-pdo-dblib
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-pgsql
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-process
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-pspell
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-recode
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-snmp
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-soap
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-tidy
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-xml
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-xmlrpc
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
Common Weakness Enumeration
References
https://bugs.php.net/bug.php?id=78943
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
https://seclists.org/bugtraq/2020/Feb/27
https://security.netapp.com/advisory/ntap-20200103-0002/
https://www.debian.org/security/2020/dsa-4626
https://www.tenable.com/security/tns-2021-14
https://bugs.php.net/bug.php?id=78943
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
https://seclists.org/bugtraq/2020/Feb/27
https://security.netapp.com/advisory/ntap-20200103-0002/
https://www.debian.org/security/2020/dsa-4626
https://www.tenable.com/security/tns-2021-14