CVE-2019-11049
Medium
Description
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Php
PublishedDec 23, 2019
First seenDec 23, 2019
Weakness typeCWE-415CWE-415
How to fix
Update
- tenable security_center5.19.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php php | 7.3.0 ≤ v ≤ 7.3.13, 7.4.0 | — |
| fedoraproject fedora | 30, 31 | — |
| debian debian_linux | 10.0 | — |
| tenable security_center | v < 5.19.0 | 5.19.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.