PT-2018-2632 · Php+2 · Php+2

Published 2018-12-07 · Updated 2024-06-15 · CVE-2018-19935

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PHP versions prior to 7.3.0

Description The issue is related to errors in processing an empty string in the message argument to the imap mail function, which can cause a denial of service (NULL pointer dereference and application crash). This can be exploited by remote attackers.

Recommendations For versions prior to 7.3.0, update to version 7.3.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of empty strings in the message argument to the imap mail function until a patch is applied.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2019-1060

BDU:2019-01249

CVE-2018-19935

DLA-1608-1

DSA-4353-1

OPENSUSE-SU-2019:1572-1

OPENSUSE-SU-2019:1573-1

OPENSUSE-SU-2019_0207-1

OPENSUSE-SU-2019_1572-1

OPENSUSE-SU-2019_1573-1

OPENSUSE-SU-2022_4067-1

OPENSUSE-SU-2024:11167-1

OPENSUSE-SU-2024:11169-1

SUSE-SU-2019:0333-1

SUSE-SU-2019:1461-1

SUSE-SU-2019_0333-1

SUSE-SU-2019_1461-1

SUSE-SU-2022:4067-1

Affected Products

Alt Linux

Php

Suse

References · 408

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/php_fpm_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/php_imap_open_rce.rb · Exploit
• 🔥 https://github.com/Bo0oM/PHP_imap_open_exploit/blob/master/exploit.php · Exploit
• 🔥 https://github.com/theMiddleBlue/CVE-2019-11043 · Exploit
• 🔥 https://github.com/jas502n/CVE-2019-11043 · Exploit
• 🔥 https://github.com/akamajoris/CVE-2019-11043-Docker · Exploit
• 🔥 https://github.com/k8gege/CVE-2019-11043 · Exploit
• 🔥 https://github.com/0th3rs-Security-Team/CVE-2019-11043 · Exploit
• 🔥 https://github.com/kriskhub/CVE-2019-11043 · Exploit
• 🔥 https://github.com/ypereirareis/docker-CVE-2019-11043 · Exploit
• 🔥 https://github.com/AleWong/PHP-FPM-Remote-Code-Execution-Vulnerability-CVE-2019-11043- · Exploit
• 🔥 https://github.com/amitlttwo/CVE-2022-31626 · Exploit
• 🔥 https://github.com/lindemer/CVE-2019-11043 · Exploit
• 🔥 https://github.com/huowen/CVE-2019-11043 · Exploit
• 🔥 https://github.com/MRdoulestar/CVE-2019-11043 · Exploit