p PatchFirst

CVE-2019-11071

CVE-2019-11071

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.

CVSS 8.8 · High · EPSS 2.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • spip Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.2.4-1

    Update to 3.2.4-1

  • spip Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.2.4-1

    Update to 3.2.4-1

  • spip Ubuntu:18.04:LTS

    Versions
    • 3.1.4-3
    Affected ranges
    • ECOSYSTEM: < 3.1.4-4~deb9u3build0.18.04.1

    Update to 3.1.4-4~deb9u3build0.18.04.1

Original sources

Check your server →