Headline
CVE-2019-11049: mail() may release string with refcount==1 twice
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
Sec Bug #78943
mail() may release string with refcount==1 twice
Submitted:
2019-12-10 17:12 UTC
Modified:
2019-12-16 19:08 UTC
From:
Assigned:
stas (profile)
Status:
Closed
Package:
*Mail Related
PHP Version:
7.3.13RC1
OS:
Windows
Private report:
No
CVE-ID:
2019-11049
Patchesadd-fronk-support (last revision 2022-07-18 03:19 UTC by 1033831147 at qq dot com)
Add a Patch
Pull Requests
Add a Pull Request
History
AllCommentsChangesGit/SVN commitsRelated reports
[2019-12-10 17:12 UTC] [email protected]
-Type: Bug +Type: Security -Private report: No +Private report: Yes
[2019-12-10 17:37 UTC] [email protected]
-PHP Version: 7.2.26RC1 +PHP Version: 7.3.13RC1
[2019-12-10 17:38 UTC] [email protected]
-Operating System: * +Operating System: Windows
[2019-12-10 17:38 UTC] [email protected]
This affects Windows only.
[2019-12-10 17:45 UTC] [email protected]
-Assigned To: +Assigned To: stas
[2019-12-10 20:07 UTC] [email protected]
Sure. Not clear how this got into PCRE2 patch?
[2019-12-16 19:07 UTC] [email protected]
-CVE-ID: +CVE-ID: 2019-11049
[2019-12-16 19:07 UTC] [email protected]
Not sure it’s even exploitable, but since mail could deal with external data, I’ll add a CVE just in case.
[2019-12-16 19:08 UTC] [email protected]
-Status: Assigned +Status: Closed
[2019-12-16 19:08 UTC] [email protected]
The fix for this bug has been committed. If you are still experiencing this bug, try to check out latest source from https://github.com/php/php-src and re-test. Thank you for the report, and for helping us make PHP better.
Related news
The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.