Bug 1788586 (CVE-2019-11049)

Summary:	CVE-2019-11049 php: double free when supplying custom headers to mail function
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora, hhorak, jorton, rcollet, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-01-09 19:10:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1788587

Description Guilherme de Almeida Suckevicz 2020-01-07 14:54:47 UTC

In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.

Reference:
https://bugs.php.net/bug.php?id=78943

Comment 1 Marco Benatto 2020-01-09 19:06:18 UTC

Statement:

This issue doesn't affect any PHP version as shipped with Red Hat Enterprise Linux or Red Hat Software Collection versions, as the flawed component is exclusive to Windows.