In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade apcu-panelUpgrade phpUpgrade php-opcacheUpgrade php-pecl-apcu-develUpgrade php-pgsqlUpgrade php-soapUpgrade php-dbgUpgrade php-embeddedUpgrade php-intlUpgrade libzipUpgrade php-ldapUpgrade php-dbaUpgrade libzip-toolsUpgrade php-commonUpgrade php-odbcUpgrade libzip-develUpgrade php-processUpgrade php-mbstringUpgrade php-cliUpgrade php-gmpUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-snmpUpgrade php-mysqlndUpgrade php-develUpgrade php-xmlUpgrade php-jsonUpgrade php-recodeUpgrade php-pearUpgrade php-bcmathUpgrade php-pecl-apcuUpgrade php-gdUpgrade php-pecl-zipUpgrade php-enchant | May 4, 2022 | Feb 21, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Feb 21, 2019 |
| Centos_linux | — | Upgrade php-xmlUpgrade libzip-develUpgrade php-mbstring-debuginfoUpgrade php-cliUpgrade php-commonUpgrade php-opcache-debuginfoUpgrade php-fpmUpgrade php-dbgUpgrade php-opcacheUpgrade php-common-debuginfoUpgrade php-soap-debuginfoUpgrade php-develUpgrade php-pecl-apcuUpgrade php-debuginfoUpgrade php-recodeUpgrade php-pearUpgrade php-pgsql-debuginfoUpgrade php-mysqlndUpgrade php-enchant-debuginfoUpgrade php-xmlrpcUpgrade apcu-panelUpgrade php-bcmath-debuginfoUpgrade phpUpgrade php-dbg-debuginfoUpgrade php-ldapUpgrade php-recode-debuginfoUpgrade php-mbstringUpgrade php-snmpUpgrade php-pecl-zip-debuginfoUpgrade php-embedded-debuginfoUpgrade php-gmp-debuginfoUpgrade php-gmpUpgrade libzip-debugsourceUpgrade php-soapUpgrade php-pecl-apcu-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade php-pdoUpgrade php-odbc-debuginfoUpgrade php-ldap-debuginfoUpgrade php-embeddedUpgrade php-process-debuginfoUpgrade php-debugsourceUpgrade php-gd-debuginfoUpgrade libzip-debuginfoUpgrade php-gdUpgrade php-intl-debuginfoUpgrade php-enchantUpgrade php-json-debuginfoUpgrade php-intlUpgrade php-jsonUpgrade php-dba-debuginfoUpgrade php-snmp-debuginfoUpgrade php-processUpgrade php-pecl-apcu-develUpgrade php-pecl-apcu-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-dbaUpgrade php-fpm-debuginfoUpgrade php-xml-debuginfoUpgrade php-pgsqlUpgrade php-pdo-debuginfoUpgrade libzipUpgrade php-odbcUpgrade php-cli-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-zipUpgrade libzip-tools | Apr 29, 2020 | Feb 21, 2019 |
| Debian | — | Upgrade php7.3 | Feb 25, 2019 | Feb 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-ldapUpgrade php-odbcUpgrade php-cliUpgrade php-recodeUpgrade php-gdUpgrade phpUpgrade php-pdoUpgrade php-commonUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-processUpgrade php-pgsqlUpgrade php-soapUpgrade php-mysql | Apr 2, 2019 | Feb 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-pgsqlUpgrade php-odbcUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-commonUpgrade php-mysqlUpgrade php-processUpgrade php-gdUpgrade phpUpgrade php-soapUpgrade php-recodeUpgrade php-cliUpgrade php-ldapUpgrade php-pdo | Mar 27, 2019 | Feb 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade php-soapUpgrade php-gdUpgrade phpUpgrade php-pgsqlUpgrade php-processUpgrade php-cliUpgrade php-xmlrpcUpgrade php-odbcUpgrade php-xmlUpgrade php-ldapUpgrade php-commonUpgrade php-recodeUpgrade php-pdoUpgrade php-mysql | Apr 3, 2019 | Feb 21, 2019 |
| Oracle_linux | — | Upgrade php-dbaUpgrade php-develUpgrade php-enchantUpgrade php-gmpUpgrade php-gdUpgrade php-embeddedUpgrade php-fpmUpgrade php-pgsqlUpgrade php-ldapUpgrade php-intlUpgrade php-pdoUpgrade libzipUpgrade php-bcmathUpgrade php-processUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-pecl-zipUpgrade php-soapUpgrade php-xmlUpgrade php-opcacheUpgrade phpUpgrade php-pecl-apcuUpgrade php-xmlrpcUpgrade php-mbstringUpgrade libzip-toolsUpgrade php-odbcUpgrade php-dbgUpgrade php-commonUpgrade apcu-panelUpgrade php-recodeUpgrade php-mysqlndUpgrade php-cliUpgrade php-pearUpgrade libzip-develUpgrade php-snmp | Jul 22, 2024 | Nov 12, 2018 |
| Php | — | Upgrade to PHP version 7.2.13Upgrade to PHP version 5.6.39Upgrade to PHP version 7.1.25 | Feb 25, 2019 | Feb 21, 2019 |
| Redhat_linux | — | Upgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-bcmath-debuginfoUpgrade libzip-develUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-common-debuginfoNo solution existsUpgrade php-xmlrpcUpgrade php-mbstring-debuginfoUpgrade php-odbcUpgrade php-xmlUpgrade php-opcache-debuginfoUpgrade php-cli-debuginfoUpgrade libzip-toolsUpgrade php-pearUpgrade php-pgsqlUpgrade php-snmpUpgrade php-odbc-debuginfoUpgrade php-enchant-debuginfoUpgrade php-snmp-debuginfoUpgrade php-dba-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-ldap-debuginfoUpgrade php-soap-debuginfoUpgrade php-fpm-debuginfoUpgrade php-commonUpgrade php-dbgUpgrade php-xml-debuginfoUpgrade php-intl-debuginfoUpgrade php-mbstringUpgrade php-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-gmpUpgrade php-pecl-apcu-develUpgrade php-dbg-debuginfoUpgrade php-gd-debuginfoUpgrade php-bcmathUpgrade php-gmp-debuginfoUpgrade php-soapUpgrade apcu-panelUpgrade php-embedded-debuginfoUpgrade phpUpgrade php-pecl-apcuUpgrade php-intlUpgrade php-enchantUpgrade php-xmlrpc-debuginfoUpgrade php-embeddedUpgrade php-processUpgrade php-opcacheUpgrade php-gdUpgrade php-dbaUpgrade php-pecl-zipUpgrade php-recodeUpgrade libzipUpgrade php-cliUpgrade php-debugsourceUpgrade php-ldapUpgrade php-fpmUpgrade php-pgsql-debuginfoUpgrade php-pdoUpgrade php-jsonUpgrade php-mysqlndUpgrade php-recode-debuginfoUpgrade libzip-debugsourceUpgrade php-develUpgrade php-process-debuginfoUpgrade libzip-tools-debuginfo | Apr 29, 2020 | Feb 21, 2019 |
| Rocky_linux | — | Upgrade php-debugsourceUpgrade phpUpgrade php-recode-debuginfoUpgrade libzip-develUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-debuginfoUpgrade php-opcache-debuginfoUpgrade php-fpmUpgrade php-enchant-debuginfoUpgrade php-mbstringUpgrade php-develUpgrade php-mysqlndUpgrade php-xmlrpcUpgrade php-embeddedUpgrade php-cliUpgrade php-common-debuginfoUpgrade php-dbg-debuginfoUpgrade php-recodeUpgrade php-pecl-apcuUpgrade php-enchantUpgrade php-snmpUpgrade php-intl-debuginfoUpgrade php-xmlUpgrade php-embedded-debuginfoUpgrade php-opcacheUpgrade php-soap-debuginfoUpgrade php-processUpgrade php-gmp-debuginfoUpgrade php-json-debuginfoUpgrade php-odbcUpgrade php-intlUpgrade php-pdoUpgrade php-gdUpgrade php-odbc-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-cli-debuginfoUpgrade php-pgsqlUpgrade libzip-tools-debuginfoUpgrade libzip-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-ldapUpgrade php-dbgUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade php-pdo-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-gmpUpgrade php-jsonUpgrade php-pecl-zipUpgrade libzip-toolsUpgrade php-ldap-debuginfoUpgrade php-commonUpgrade php-xml-debuginfoUpgrade php-bcmathUpgrade libzipUpgrade php-pgsql-debuginfoUpgrade php-dbaUpgrade php-fpm-debuginfoUpgrade php-dba-debuginfoUpgrade php-snmp-debuginfoUpgrade php-soapUpgrade php-process-debuginfoUpgrade php-pecl-apcu-devel | Mar 12, 2024 | Feb 21, 2019 |
| Suse | — | Upgrade php7-fastcgiUpgrade php53Upgrade php72-gdUpgrade php72-memcachedUpgrade php7-iconvUpgrade php72-pear-archive_tarUpgrade php53-opensslUpgrade apache2-mod_php72Upgrade php53-zipUpgrade php72-gettextUpgrade php72-opensslUpgrade tidyUpgrade php53-pspellUpgrade php53-fastcgiUpgrade php7-calendarUpgrade php53-posixUpgrade php72-sysvshmUpgrade php5-snmpUpgrade php72-socketsUpgrade php72-mbstringUpgrade php53-pearUpgrade php53-mysqlUpgrade php7-pearUpgrade php7-sysvshmUpgrade php53-zlibUpgrade php72-xmlrpcUpgrade php5-pcntlUpgrade php5-posixUpgrade php7-ctypeUpgrade php72-enchantUpgrade php72-calendarUpgrade php72-ldapUpgrade php72-dbaUpgrade php53-intlUpgrade php53-pgsqlUpgrade php53-pcntlUpgrade php72-iconvUpgrade php5-shmopUpgrade php53-xmlwriterUpgrade php53-xmlreaderUpgrade php72-tidyUpgrade apache2-mod_php5Upgrade php7-testresultsUpgrade php72-pharUpgrade php5-bz2Upgrade php72-pearUpgrade php53-fileinfoUpgrade php5-gmpUpgrade php5-ldapUpgrade php53-readlineUpgrade php5-iconvUpgrade php7-intlUpgrade php53-develUpgrade php7-posixUpgrade php5-jsonUpgrade libmemcachedutil2Upgrade php7-wddxUpgrade php72-xslUpgrade php7-xslUpgrade php5-suhosinUpgrade php7-opensslUpgrade php53-imapUpgrade php72-sysvmsgUpgrade php72-bz2Upgrade php53-socketsUpgrade php72-snmpUpgrade php5-intlUpgrade php53-soapUpgrade php7-fpmUpgrade php53-sysvshmUpgrade php72-mysqlUpgrade php7-tidyUpgrade php5-imapUpgrade php5-sysvmsgUpgrade php7-embedUpgrade php72-bcmathUpgrade php7-readlineUpgrade php72-sqliteUpgrade php72-pdoUpgrade php5-mysqlUpgrade php7-xmlreaderUpgrade php5-xmlrpcUpgrade php5-socketsUpgrade php7-pcntlUpgrade php53-sqliteUpgrade php5-opensslUpgrade php7-pgsqlUpgrade php7-enchantUpgrade libmemcached11Upgrade php72-domUpgrade php53-curlUpgrade php7-xmlwriterUpgrade php7-domUpgrade php72-shmopUpgrade php5-xslUpgrade php53-tidyUpgrade php7-mcryptUpgrade php72Upgrade php5-domUpgrade php53-mcryptUpgrade php7-xmlrpcUpgrade php7-exifUpgrade php72-fileinfoUpgrade libtidy-0_99-0-develUpgrade php5-pearUpgrade php53-ftpUpgrade php72-odbcUpgrade php53-sysvsemUpgrade php7-ftpUpgrade php5-pharUpgrade php7-curlUpgrade php7-pdoUpgrade php5-mcryptUpgrade php53-sysvmsgUpgrade apache2-mod_php7Upgrade php53-ctypeUpgrade php53-pdoUpgrade php72-zipUpgrade php7-imapUpgrade php7-dbaUpgrade php72-xmlreaderUpgrade php53-gdUpgrade php53-ldapUpgrade php5-ftpUpgrade php7-gettextUpgrade php5-zipUpgrade php72-fastcgiUpgrade php53-wddxUpgrade php72-zlibUpgrade php7-sysvmsgUpgrade libmemcachedUpgrade php5-xmlreaderUpgrade php72-readlineUpgrade php72-pgsqlUpgrade php53-mbstringUpgrade php7-tokenizerUpgrade php7-jsonUpgrade php7-fileinfoUpgrade php53-jsonUpgrade php53-calendarUpgrade php7-bcmathUpgrade php7-soapUpgrade php5-sysvsemUpgrade php5-wddxUpgrade php72-curlUpgrade php5-pdoUpgrade php72-pspellUpgrade php7-gmpUpgrade php5-gettextUpgrade php53-iconvUpgrade php53-suhosinUpgrade php72-tokenizerUpgrade php7-snmpUpgrade php5-develUpgrade php7Upgrade php7-mbstringUpgrade php5Upgrade php53-odbcUpgrade php53-shmopUpgrade libmemcached-develUpgrade php7-gdUpgrade php5-fastcgiUpgrade php7-pharUpgrade php72-xmlwriterUpgrade php72-fpmUpgrade php5-bcmathUpgrade php7-firebirdUpgrade php5-ctypeUpgrade php7-bz2Upgrade php5-mbstringUpgrade php72-soapUpgrade php5-pspellUpgrade php5-pgsqlUpgrade php53-dbaUpgrade php7-sysvsemUpgrade php5-xmlwriterUpgrade php53-tokenizerUpgrade php53-gmpUpgrade php5-sqliteUpgrade apache2-mod_php53Upgrade php5-fileinfoUpgrade php5-soapUpgrade php53-gettextUpgrade php7-sqliteUpgrade php53-bcmathUpgrade php72-imapUpgrade php7-socketsUpgrade php5-exifUpgrade php72-gmpUpgrade php7-opcacheUpgrade php5-enchantUpgrade php53-xmlrpcUpgrade php53-exifUpgrade php53-domUpgrade php5-odbcUpgrade php7-pspellUpgrade php72-ctypeUpgrade php5-tokenizerUpgrade php7-develUpgrade php72-exifUpgrade php7-zipUpgrade php72-pcntlUpgrade php5-fpmUpgrade php7-pear-archive_tarUpgrade php53-bz2Upgrade php5-zlibUpgrade php53-xslUpgrade php53-snmpUpgrade php7-odbcUpgrade php5-opcacheUpgrade php7-sodiumUpgrade php72-jsonUpgrade php7-zlibUpgrade php72-opcacheUpgrade php72-wddxUpgrade php72-intlUpgrade php7-ldapUpgrade php5-curlUpgrade php7-shmopUpgrade php7-mysqlUpgrade php5-calendarUpgrade libtidy-0_99-0Upgrade php72-ftpUpgrade php5-dbaUpgrade php72-sysvsemUpgrade php5-gdUpgrade php72-posixUpgrade php5-sysvshmUpgrade php72-devel | Apr 6, 2019 | Feb 21, 2019 |
| Ubuntu | — | Upgrade php5-fpmUpgrade php5-cli (Ubuntu Pro)Upgrade php5-cgiUpgrade php5-fpm (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cliUpgrade php5-cgi (Ubuntu Pro) | May 23, 2019 | Feb 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub