DSA-4553: -1 php7.3 -- security update

Published Oct 28, 2019

Updated

Emil Lerner and Andrew Danau discovered that insufficient validation in the path handling code of PHP FPM could result in the execution of arbitrary code in some setups.

Affected Software

2 affected components

debian/php7.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade php7.3 to a version that resolves this vulnerability.
Patch DSA-4553-1

Event History

Oct 28, 2019

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2019-11043

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects PHP FPM setups where insufficient validation in path handling can be reached. The advisory describes exploitation as possible only in some setups and does not identify the specific configurations.

What could an attacker achieve if the vulnerable path handling is exploitable?

An attacker could execute arbitrary code.