EXPOSURES › CVE-2019-11049

CVE-2019-11049

MEDIUM

DETAIL

SourceNVD · cve Published2019-12-23 CVSS6.5 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2019-11049 ↗

▸ RECOMMENDED ACTION Patch the affected products and confirm your instances are covered.

PLAYERS IMPLICATED

Microsoft · vendor debian · vendor fedoraproject · vendor php · vendor tenable · vendor debian linux · product fedora · product php · product security center · product windows · product

DESCRIPTION

In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.

AFFECTED FEDRAMP PRODUCTS · 5

PRODUCT	PROVIDER	STATUS	MATCH
Azure Commercial Cloud Microsoft	Microsoft	Authorized	vendor-exact · 0.90
Azure Government (includes Dynamics 365) Microsoft	Microsoft	Authorized	vendor-exact · 0.90
Microsoft Office 365 GCC High Microsoft	Microsoft	In Process	vendor-exact · 0.90
Office 365 Multi-Tenant & Supporting Services Microsoft	Microsoft	Authorized	vendor-exact · 0.90
Tenable.io Tenable Public Sector (TPS)	Tenable Public Sector (TPS)	Authorized	vendor-exact · 0.90