Critical severity · published Dec 23, 2019
CVE-2019-11049
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit…
9.8
CVSS
4.2%
EPSS
No
On KEV
Description
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
7.3.0 through 7.3.13; 7.4.0 · source: NVD
DL
Debian Linux · Debian
10.0 · source: NVD
FE
Fedora · Fedoraproject
30; 31 · source: NVD
SC
Security Center · Tenable
before 5.19.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11049
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11049
Mailing List
https://bugs.php.net/bug.php?id=78943
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
Mailing List
https://seclists.org/bugtraq/2020/Feb/27
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0002/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4626
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability