CVE-2021-21703
published 2021-10-25CVE-2021-21703: In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as…
PriorityP336high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
1.34%
68.1th percentile
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | php7.4 | < php7.4 7.4.25-1+deb11u1 (bullseye) | php7.4 7.4.25-1+deb11u1 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | >= 0 < 5.4.0-214.234 | 5.4.0-214.234 |
| msrc | cbl2_php_on_cbl_mariner_2.0 | — | — |
| oracle | communications_diameter_signaling_router | 8.0.0.0 – 8.5.0.2 | — |
| php | php | 7.3.0 – 7.3.31 | — |
| php | php | >= 7.4.0 < 7.4.25 | 7.4.25 |
| php | php | >= 8.0.0 < 8.0.12 | 8.0.12 |
| php_group | php | 7.3.x – 7.3.31 | — |
| php_group | php | >= 7.4.x < 7.4.25 | 7.4.25 |
| php_group | php | >= 8.0.X < 8.0.12 | 8.0.12 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_oracle7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Festo Didactic SE MES PC
cisa_ics·2026-01-27·CVSS 7.5
[HIGH] Festo Didactic SE MES PC
ICS Advisory
##
Festo Didactic SE MES PC
Release DateJanuary 27, 2026
Alert CodeICSA-26-027-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications. MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.
The
Oracle
Oracle Oracle Communications Risk Matrix: Platform (PHP) — CVE-2021-21703
vendor_oracle·2022-01-15·CVSS 7.0
CVE-2021-21703 [HIGH] Oracle Oracle Communications Risk Matrix: Platform (PHP) — CVE-2021-21703
Oracle Oracle Communications Risk Matrix: Platform (PHP) vulnerability
CVE: CVE-2021-21703
CVSS: 7.0
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujan2022 (JAN 2022)
Ubuntu
PHP vulnerability
vendor_ubuntu·2021-10-27
CVE-2021-21703 PHP vulnerability
Title: PHP vulnerability
Summary: PHP-PFM in PHP could be made to run program as an administrator
if it received specially crafted input.
It was discovered that PHP-FPM in PHP incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
php: Local privilege escalation via PHP-FPM
vendor_redhat·2021-10-20·CVSS 7.8
CVE-2021-21703 [HIGH] CWE-119 php: Local privilege escalation via PHP-FPM
php: Local privilege escalation via PHP-FPM
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
php-fpm has a vulnerability which may lead to local privilege escalation. This vulnerability is hard to exploit as the attack needs to escape the FPM sandbox mechanism. When a complete attack is achieved it may lead to risk for confidenti
Microsoft
PHP-FPM memory access in root process leading to privilege escalation
vendor_msrc·2021-10-12·CVSS 7.8
CVE-2021-21703 [HIGH] CWE-787 PHP-FPM memory access in root process leading to privilege escalation
PHP-FPM memory access in root process leading to privilege escalation
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: htt
Debian
CVE-2021-21703: php7.4 - In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x b...
vendor_debian·2021·CVSS 7.8
CVE-2021-21703 [HIGH] CVE-2021-21703: php7.4 - In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x b...
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
Scope: local
bullseye: resolved (fixed in 7.4.25-1+deb11u1)
OSV
linux-xilinx-zynqmp vulnerabilities
osv·2025-05-02·CVSS 5.5
CVE-2025-21703 linux-xilinx-zynqmp vulnerabilities
linux-xilinx-zynqmp vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Network drivers;
- File systems infrastructure;
- Ext4 file system;
- Network file system (NFS) server daemon;
- Bluetooth subsystem;
- IPv6 networking;
- Network traffic control;
(CVE-2025-21703, CVE-2024-53237, CVE-2024-50256, CVE-2024-56651,
CVE-2024-46826, CVE-2025-21700, CVE-2021-47119, CVE-2024-26915,
CVE-2025-21702, CVE-2024-49974, CVE-2024-35958)
OSV
linux-azure-fips, linux-fips, linux-gcp-fips vulnerabilities
osv·2025-04-24·CVSS 5.5
CVE-2021-47119 linux-azure-fips, linux-fips, linux-gcp-fips vulnerabilities
linux-azure-fips, linux-fips, linux-gcp-fips vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Network drivers;
- File systems infrastructure;
- Ext4 file system;
- Network file system (NFS) server daemon;
- Bluetooth subsystem;
- IPv6 networking;
- Network traffic control;
(CVE-2021-47119, CVE-2024-35958, CVE-2025-21700, CVE-2024-53237,
CVE-2024-46826, CVE-2025-21703, CVE-2024-49974, CVE-2025-21702,
CVE-2024-56651, CVE-2024-26915, CVE-2024-50256)
OSV
linux-aws, linux-aws-5.4, linux-gcp-5.4, linux-iot vulnerabilities
osv·2025-04-24·CVSS 5.5
linux-aws, linux-aws-5.4, linux-gcp-5.4, linux-iot vulnerabilities
linux-aws, linux-aws-5.4, linux-gcp-5.4, linux-iot vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Network drivers;
- File systems infrastructure;
- Ext4 file system;
- Network file system (NFS) server daemon;
- SMB network file system;
- Network namespace;
- Bluetooth subsystem;
- Networking core;
- IPv6 networking;
- Network traffic control;
(CVE-2024-56658, CVE-2025-21700, CVE-2025-21703, CVE-2024-35864,
CVE-2024-26915, CVE-2021-47119, CVE-2025-21702, CVE-2024-50256,
CVE-2024-35958, CVE-2024-26928, CVE-2024-49974, CVE-2024-46826,
CVE-2024-53237, CVE-2024-56651)
OSV
linux-aws-fips vulnerabilities
osv·2025-04-24·CVSS 5.5
linux-aws-fips vulnerabilities
linux-aws-fips vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Network drivers;
- File systems infrastructure;
- Ext4 file system;
- Network file system (NFS) server daemon;
- SMB network file system;
- Network namespace;
- Bluetooth subsystem;
- Networking core;
- IPv6 networking;
- Network traffic control;
(CVE-2024-56651, CVE-2021-47119, CVE-2025-21700, CVE-2025-21702,
CVE-2024-49974, CVE-2024-56658, CVE-2024-53237, CVE-2025-21703,
CVE-2024-26928, CVE-2024-26915, CVE-2024-35958, CVE-2024-50256,
CVE-2024-35864, CVE-2024-46826)
OSV
linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-hwe-5.4, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4 vulnerabilities
osv·2025-04-24·CVSS 5.5
linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-hwe-5.4, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4 vulnerabilities
linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-hwe-5.4, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Network drivers;
- File systems infrastructure;
- Ext4 file system;
- Network file system (NFS) server daemon;
- Bluetooth subsystem;
- IPv6 networking;
- Network traffic control;
(CVE-2024-53237, CVE-2024-50256, CVE-2021-47119, CVE-2024-35958,
CVE-2025-21700, CVE-2025-21703, CVE-2024-56651, CVE-2024-49974,
CVE-2025-21702, CVE-2024-26915, CVE-2024-46826)
GHSA
GHSA-h8qx-36w6-3rc4: In PHP versions 7
ghsa_unreviewed·2022-05-24
CVE-2021-21703 [HIGH] CWE-787 GHSA-h8qx-36w6-3rc4: In PHP versions 7
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
OSV
CVE-2021-21703: In PHP versions 7
osv·2021-10-25·CVSS 7.0
CVE-2021-21703 [HIGH] CVE-2021-21703: In PHP versions 7
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2021/10/26/7https://bugs.php.net/bug.php?id=81026https://lists.debian.org/debian-lts-announce/2021/10/msg00021.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PZVLICZUJMXOGWOUWSBAEGIVTF6Y6V3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JO5RA6YOBGGGKLIA6F6BQRZDDECF5L3R/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBM3KKB3RY2YPOKNMC4HIH7IH3T3WC74/https://security.gentoo.org/glsa/202209-20https://security.netapp.com/advisory/ntap-20211118-0003/https://www.debian.org/security/2021/dsa-4992https://www.debian.org/security/2021/dsa-4993https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttp://www.openwall.com/lists/oss-security/2021/10/26/7https://bugs.php.net/bug.php?id=81026https://lists.debian.org/debian-lts-announce/2021/10/msg00021.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PZVLICZUJMXOGWOUWSBAEGIVTF6Y6V3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JO5RA6YOBGGGKLIA6F6BQRZDDECF5L3R/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBM3KKB3RY2YPOKNMC4HIH7IH3T3WC74/https://security.gentoo.org/glsa/202209-20https://security.netapp.com/advisory/ntap-20211118-0003/https://www.debian.org/security/2021/dsa-4992https://www.debian.org/security/2021/dsa-4993https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.html
2021-10-25
Published