CVE-2019-11049

In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugs.php.net/bug.php?id=78943	Mailing List Patch Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
https://seclists.org/bugtraq/2020/Feb/27	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0002/	Third Party Advisory
https://www.debian.org/security/2020/dsa-4626	Third Party Advisory
https://www.tenable.com/security/tns-2021-14	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php:7.4.0:::::::*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:30:::::::*
	cpe:2.3:o:fedoraproject:fedora:31:::::::*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:tenable:securitycenter:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-12-23 03:15

Updated : 2023-11-07 03:02

NVD link : CVE-2019-11049

Mitre link : CVE-2019-11049

CVE.ORG link : CVE-2019-11049

JSON object : View

Products Affected

microsoft

windows

fedoraproject

fedora

tenable

securitycenter

debian

debian_linux

php

php

CWE

CWE-415

Double Free

{"id": "CVE-2019-11049", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security@php.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.2}]}, "published": "2019-12-23T03:15:11.897", "references": [{"url": "https://bugs.php.net/bug.php?id=78943", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "source": "security@php.net"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/", "source": "security@php.net"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/", "source": "security@php.net"}, {"url": "https://seclists.org/bugtraq/2020/Feb/27", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@php.net"}, {"url": "https://security.netapp.com/advisory/ntap-20200103-0002/", "tags": ["Third Party Advisory"], "source": "security@php.net"}, {"url": "https://www.debian.org/security/2020/dsa-4626", "tags": ["Third Party Advisory"], "source": "security@php.net"}, {"url": "https://www.tenable.com/security/tns-2021-14", "tags": ["Third Party Advisory"], "source": "security@php.net"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-415"}]}, {"type": "Secondary", "source": "security@php.net", "description": [{"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations."}, {"lang": "es", "value": "En PHP versiones 7.3.x por debajo de 7.3.13 y 7.4.0 en Windows, al suministrar encabezados personalizados para la funci\u00f3n mail(), debido a un error introducido en el commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, si el encabezado se suministra en min\u00fasculas, esto puede resultar en una doble liberaci\u00f3n de ciertas ubicaciones de memoria."}], "lastModified": "2023-11-07T03:02:38.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2083CFF8-5F24-46C7-AA69-F8AE86874E70", "versionEndIncluding": "7.3.13", "versionStartIncluding": "7.3.0"}, {"criteria": "cpe:2.3:a:php:php:7.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB281E6F-3CB5-49C4-B62C-307AEA35AE56"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tenable:securitycenter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFDEC754-9E4C-4FCE-8B91-0FAB7CBC4BA1", "versionEndExcluding": "5.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@php.net"}