An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-apcu-develUpgrade php-develUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-pgsqlUpgrade php-pdoUpgrade php-commonUpgrade php-odbcUpgrade php-dbgUpgrade php-mbstringUpgrade php-jsonUpgrade php-soapUpgrade php-ldapUpgrade php-gmpUpgrade php-dbaUpgrade apcu-panelUpgrade php-recodeUpgrade php-gdUpgrade php-cliUpgrade libzip-toolsUpgrade php-mysqlndUpgrade php-embeddedUpgrade php-xmlUpgrade libzipUpgrade php-xmlrpcUpgrade php-opcacheUpgrade php-pearUpgrade libzip-develUpgrade php-fpmUpgrade php-processUpgrade php-snmpUpgrade php-pecl-zipUpgrade phpUpgrade php-bcmathUpgrade php-enchant | May 4, 2022 | Feb 22, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Feb 22, 2019 |
| Centos_linux | — | Upgrade php-gmp-debuginfoUpgrade php-snmpUpgrade php-mysqlndUpgrade php-xmlUpgrade php-bcmath-debuginfoUpgrade libzipUpgrade php-dbg-debuginfoUpgrade php-embedded-debuginfoUpgrade php-gdUpgrade php-ldapUpgrade libzip-develUpgrade php-pgsql-debuginfoUpgrade php-bcmathUpgrade php-soapUpgrade php-recode-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-dbaUpgrade php-intlUpgrade php-processUpgrade php-enchantUpgrade php-opcacheUpgrade php-recodeUpgrade libzip-debugsourceUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-pdoUpgrade phpUpgrade php-gd-debuginfoUpgrade php-soap-debuginfoUpgrade php-debugsourceUpgrade php-pecl-zipUpgrade libzip-tools-debuginfoUpgrade php-cliUpgrade php-embeddedUpgrade php-opcache-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-fpmUpgrade php-enchant-debuginfoUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-intl-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-ldap-debuginfoUpgrade php-develUpgrade php-gmpUpgrade php-xml-debuginfoUpgrade php-xmlrpcUpgrade php-odbcUpgrade php-pgsqlUpgrade php-dbgUpgrade php-snmp-debuginfoUpgrade php-cli-debuginfoUpgrade php-commonUpgrade php-fpm-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-apcuUpgrade php-pdo-debuginfoUpgrade php-mbstringUpgrade php-pearUpgrade php-json-debuginfoUpgrade php-odbc-debuginfoUpgrade php-process-debuginfoUpgrade php-common-debuginfoUpgrade libzip-debuginfoUpgrade php-dba-debuginfo | Apr 29, 2020 | Feb 22, 2019 |
| Debian | — | Upgrade php7.3 | Feb 25, 2019 | Feb 22, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-pgsqlUpgrade php-ldapUpgrade php-commonUpgrade php-soapUpgrade phpUpgrade php-odbcUpgrade php-recodeUpgrade php-cliUpgrade php-mysqlUpgrade php-xmlUpgrade php-gdUpgrade php-xmlrpcUpgrade php-processUpgrade php-pdo | Apr 2, 2019 | Feb 22, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-ldapUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-mysqlUpgrade php-odbcUpgrade php-soapUpgrade php-gdUpgrade php-recodeUpgrade phpUpgrade php-processUpgrade php-commonUpgrade php-xmlUpgrade php-cli | Mar 27, 2019 | Feb 22, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade phpUpgrade php-recodeUpgrade php-ldapUpgrade php-pdoUpgrade php-processUpgrade php-cliUpgrade php-soapUpgrade php-gdUpgrade php-xmlrpcUpgrade php-commonUpgrade php-mysqlUpgrade php-odbcUpgrade php-xmlUpgrade php-pgsql | Apr 3, 2019 | Feb 22, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Feb 22, 2019 |
| Oracle_linux | — | Upgrade php-gmpUpgrade php-pecl-apcu-develUpgrade php-commonUpgrade php-dbgUpgrade php-soapUpgrade php-pgsqlUpgrade php-intlUpgrade php-dbaUpgrade apcu-panelUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-jsonUpgrade php-pdoUpgrade php-bcmathUpgrade php-odbcUpgrade php-pecl-zipUpgrade libzip-toolsUpgrade php-embeddedUpgrade php-pearUpgrade php-fpmUpgrade php-gdUpgrade libzipUpgrade php-snmpUpgrade phpUpgrade php-xmlUpgrade php-enchantUpgrade php-xmlrpcUpgrade php-processUpgrade php-develUpgrade php-cliUpgrade php-mysqlndUpgrade php-opcacheUpgrade libzip-develUpgrade php-recodeUpgrade php-mbstring | Jul 22, 2024 | Dec 6, 2018 |
| Php | — | Upgrade to PHP version 5.6.40Upgrade to PHP version 7.2.14Upgrade to PHP version 7.3.1 | Feb 27, 2019 | Feb 22, 2019 |
| Redhat_linux | — | Upgrade php-develUpgrade php-pearUpgrade php-odbc-debuginfoUpgrade php-ldapUpgrade php-xmlrpcUpgrade php-embeddedUpgrade php-embedded-debuginfoUpgrade php-debugsourceUpgrade php-bcmathUpgrade php-xml-debuginfoUpgrade php-gmpNo solution existsUpgrade php-pecl-zip-debuginfoUpgrade libzip-tools-debuginfoUpgrade libzipUpgrade php-cli-debuginfoUpgrade php-soapUpgrade php-pecl-apcu-debuginfoUpgrade php-enchantUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pgsqlUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-gdUpgrade php-gmp-debuginfoUpgrade php-pecl-zipUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-develUpgrade php-fpmUpgrade php-pdo-debuginfoUpgrade php-pdoUpgrade php-jsonUpgrade php-dbgUpgrade php-dbaUpgrade libzip-debuginfoUpgrade php-ldap-debuginfoUpgrade php-snmp-debuginfoUpgrade apcu-panelUpgrade php-mbstring-debuginfoUpgrade php-processUpgrade php-soap-debuginfoUpgrade phpUpgrade php-commonUpgrade php-xmlUpgrade php-odbcUpgrade libzip-debugsourceUpgrade php-common-debuginfoUpgrade libzip-toolsUpgrade php-opcache-debuginfoUpgrade php-cliUpgrade php-intl-debuginfoUpgrade php-recode-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-process-debuginfoUpgrade php-opcacheUpgrade php-dba-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-recodeUpgrade php-mysqlnd-debuginfoUpgrade libzip-develUpgrade php-debuginfoUpgrade php-json-debuginfoUpgrade php-mbstringUpgrade php-snmpUpgrade php-dbg-debuginfoUpgrade php-intlUpgrade php-mysqlndUpgrade php-fpm-debuginfo | Apr 29, 2020 | Feb 22, 2019 |
| Rocky_linux | — | Upgrade php-debuginfoUpgrade php-gmp-debuginfoUpgrade phpUpgrade php-gdUpgrade php-recode-debuginfoUpgrade php-gd-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-embeddedUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-processUpgrade libzip-develUpgrade php-cliUpgrade php-mysqlndUpgrade php-intl-debuginfoUpgrade php-pecl-apcuUpgrade php-recodeUpgrade php-dbg-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-opcacheUpgrade php-enchantUpgrade php-pecl-apcu-debuginfoUpgrade php-embedded-debuginfoUpgrade php-soap-debuginfoUpgrade libzipUpgrade php-debugsourceUpgrade libzip-toolsUpgrade php-snmpUpgrade php-enchant-debuginfoUpgrade php-fpmUpgrade php-odbcUpgrade php-odbc-debuginfoUpgrade php-intlUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zipUpgrade php-common-debuginfoUpgrade php-xml-debuginfoUpgrade php-gmpUpgrade php-fpm-debuginfoUpgrade php-pdoUpgrade php-ldapUpgrade php-json-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-dbgUpgrade libzip-debugsourceUpgrade php-process-debuginfoUpgrade php-mbstringUpgrade php-jsonUpgrade php-ldap-debuginfoUpgrade libzip-debuginfoUpgrade php-dba-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-bcmathUpgrade php-commonUpgrade php-cli-debuginfoUpgrade php-opcache-debuginfoUpgrade php-develUpgrade php-pecl-zip-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-snmp-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-pdo-debuginfoUpgrade php-dba | Mar 12, 2024 | Feb 22, 2019 |
| Suse | — | Upgrade php5-fpmUpgrade php72-calendarUpgrade php5-enchantUpgrade php72-pharUpgrade php7-pearUpgrade php5-pspellUpgrade php5-iconvUpgrade php5-opcacheUpgrade php5-exifUpgrade php7-pear-archive_tarUpgrade php53-dbaUpgrade php7-sysvsemUpgrade php7-enchantUpgrade php7-xmlwriterUpgrade php72-enchantUpgrade php7-calendarUpgrade php53-tokenizerUpgrade php7-wddxUpgrade php72-socketsUpgrade php53-pearUpgrade php7-snmpUpgrade php5-ldapUpgrade apache2-mod_php53Upgrade php72-jsonUpgrade php7-fastcgiUpgrade php5-domUpgrade php72-iconvUpgrade php72-gdUpgrade php7-fileinfoUpgrade php53-xslUpgrade php53-bz2Upgrade php53-jsonUpgrade php5-fileinfoUpgrade php7-mysqlUpgrade php53-domUpgrade libtidy-0_99-0Upgrade php53-opensslUpgrade php7-pspellUpgrade php72-fastcgiUpgrade php72-mbstringUpgrade php72-memcachedUpgrade php72-pcntlUpgrade php72-wddxUpgrade php72-tidyUpgrade php5-zlibUpgrade php5-curlUpgrade php72-ftpUpgrade php5-dbaUpgrade php5-gdUpgrade php5-posixUpgrade php53Upgrade php7-sqliteUpgrade php5-sqliteUpgrade php53-intlUpgrade php53-mysqlUpgrade php7-dbaUpgrade php72-pear-archive_tarUpgrade php7-pharUpgrade apache2-mod_php72Upgrade php7-mcryptUpgrade php5-mbstringUpgrade php72-opcacheUpgrade php5-ctypeUpgrade php5-intlUpgrade libmemcachedutil2Upgrade php5-odbcUpgrade php72-ctypeUpgrade php5-tokenizerUpgrade libmemcached11Upgrade php5-suhosinUpgrade php7-zlibUpgrade php72-gettextUpgrade php7-sysvshmUpgrade php72-intlUpgrade php5-shmopUpgrade php7-readlineUpgrade php7-tokenizerUpgrade php7-ctypeUpgrade php53-fastcgiUpgrade php53-gmpUpgrade php53-pcntlUpgrade php72-pspellUpgrade php53-xmlwriterUpgrade php72-dbaUpgrade php7-opcacheUpgrade tidyUpgrade php72-develUpgrade php7-shmopUpgrade php7-testresultsUpgrade php7-bcmathUpgrade php7-develUpgrade php53-exifUpgrade php72-gmpUpgrade php7-socketsUpgrade php72-ldapUpgrade php72-soapUpgrade php7-ldapUpgrade php53-develUpgrade php7-zipUpgrade php53-xmlrpcUpgrade php5-pgsqlUpgrade php7-odbcUpgrade php5-sysvshmUpgrade php53-pspellUpgrade php72-opensslUpgrade php53-shmopUpgrade libtidy-0_99-0-develUpgrade php72-xmlreaderUpgrade php53-sqliteUpgrade php53-sysvmsgUpgrade php72-snmpUpgrade php72Upgrade php5-pharUpgrade php72-sqliteUpgrade php72-shmopUpgrade php72-zlibUpgrade php72-mysqlUpgrade php7-xmlreaderUpgrade php7-iconvUpgrade php72-domUpgrade php5-soapUpgrade php5-opensslUpgrade php53-calendarUpgrade php53-zlibUpgrade libmemcachedUpgrade php72-curlUpgrade php5-xmlrpcUpgrade php7Upgrade php72-odbcUpgrade php53-mcryptUpgrade php5Upgrade php53-fileinfoUpgrade php7-jsonUpgrade php53-ctypeUpgrade php53-pdoUpgrade php5-zipUpgrade php5-bz2Upgrade php7-mbstringUpgrade php5-mysqlUpgrade php72-zipUpgrade php7-xslUpgrade php7-ftpUpgrade php53-soapUpgrade php5-mcryptUpgrade php5-pearUpgrade apache2-mod_php5Upgrade php53-pgsqlUpgrade php72-xmlrpcUpgrade php72-pgsqlUpgrade php53-posixUpgrade php53-iconvUpgrade php5-fastcgiUpgrade php7-xmlrpcUpgrade php5-snmpUpgrade php72-xmlwriterUpgrade php5-pdoUpgrade php5-socketsUpgrade php5-gettextUpgrade libmemcached-develUpgrade php5-calendarUpgrade php7-sodiumUpgrade php53-xmlreaderUpgrade php72-readlineUpgrade php72-sysvsemUpgrade php72-bz2Upgrade php7-sysvmsgUpgrade php7-pgsqlUpgrade php7-curlUpgrade php53-zipUpgrade php53-gettextUpgrade php53-mbstringUpgrade php53-ldapUpgrade php53-ftpUpgrade php53-curlUpgrade php5-wddxUpgrade php5-imapUpgrade php53-gdUpgrade php7-bz2Upgrade php53-sysvshmUpgrade php72-fpmUpgrade php7-exifUpgrade php53-bcmathUpgrade php7-gdUpgrade php7-domUpgrade php7-pcntlUpgrade php72-fileinfoUpgrade php53-readlineUpgrade php72-xslUpgrade php5-ftpUpgrade apache2-mod_php7Upgrade php72-sysvshmUpgrade php53-sysvsemUpgrade php5-xmlreaderUpgrade php72-pdoUpgrade php72-posixUpgrade php7-opensslUpgrade php7-intlUpgrade php7-posixUpgrade php7-fpmUpgrade php5-sysvmsgUpgrade php53-snmpUpgrade php53-odbcUpgrade php7-tidyUpgrade php72-bcmathUpgrade php5-xslUpgrade php53-socketsUpgrade php5-develUpgrade php53-imapUpgrade php7-gmpUpgrade php7-embedUpgrade php53-suhosinUpgrade php72-pearUpgrade php5-xmlwriterUpgrade php5-bcmathUpgrade php72-tokenizerUpgrade php7-firebirdUpgrade php5-gmpUpgrade php5-jsonUpgrade php5-sysvsemUpgrade php53-wddxUpgrade php7-pdoUpgrade php72-sysvmsgUpgrade php72-exifUpgrade php7-gettextUpgrade php7-imapUpgrade php53-tidyUpgrade php7-soapUpgrade php72-imapUpgrade php5-pcntl | Apr 6, 2019 | Feb 22, 2019 |
| Ubuntu | — | Upgrade libapache2-mod-php5Upgrade php7.0-fpmUpgrade php7.0-mbstringUpgrade php5-xmlrpcUpgrade php7.0-xmlrpcUpgrade libapache2-mod-php7.0Upgrade php7.0-cliUpgrade php5-cliUpgrade php5-fpmUpgrade php7.0-cgiUpgrade php5-cgi | Mar 15, 2019 | Feb 22, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub