Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-processUpgrade php-pecl-rrdUpgrade php-commonUpgrade libzip-toolsUpgrade php-pgsqlUpgrade php-dbaUpgrade php-fpmUpgrade php-xmlUpgrade php-develUpgrade php-pearUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-mbstringUpgrade php-pecl-apcu-develUpgrade libzip-develUpgrade php-ffiUpgrade php-bcmathUpgrade libzipUpgrade php-enchantUpgrade php-gmpUpgrade php-snmpUpgrade php-embeddedUpgrade php-jsonUpgrade php-gdUpgrade php-pecl-apcuUpgrade php-intlUpgrade php-odbcUpgrade apcu-panelUpgrade php-dbgUpgrade php-ldapUpgrade phpUpgrade php-pdoUpgrade php-soapUpgrade php-pecl-zipUpgrade php-opcacheUpgrade php-cliUpgrade php-mysqlnd | Oct 20, 2022 | Nov 19, 2020 |
| Alpine Linux | — | Upgrade drupal7 | Aug 22, 2024 | Nov 19, 2020 |
| Amazon Linux Ami 2 | — | Upgrade php-pear | Jan 8, 2021 | Nov 19, 2020 |
| Amazon_linux | — | Upgrade php7-pear | Jan 15, 2021 | Nov 19, 2020 |
| Centos_linux | — | Upgrade php-develUpgrade php-fpmUpgrade libzip-develUpgrade php-gd-debuginfoUpgrade libzipUpgrade php-pecl-xdebugUpgrade php-debugsourceUpgrade libzip-toolsUpgrade php-snmp-debuginfoUpgrade php-opcacheUpgrade php-embedded-debuginfoUpgrade php-xmlUpgrade libzip-tools-debuginfoUpgrade php-dbg-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-soap-debuginfoUpgrade php-enchantUpgrade php-pecl-rrd-debuginfoUpgrade php-cliUpgrade php-processUpgrade php-gmp-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-ffiUpgrade apcu-panelUpgrade phpUpgrade php-xmlrpcUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-snmpUpgrade php-ldap-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-rrdUpgrade php-pearUpgrade php-pecl-zipUpgrade php-gdUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-bcmathUpgrade php-intl-debuginfoUpgrade php-mbstringUpgrade libzip-debugsourceUpgrade php-jsonUpgrade php-odbcUpgrade php-odbc-debuginfoUpgrade php-cli-debuginfoUpgrade php-pdo-debuginfoUpgrade php-ffi-debuginfoUpgrade php-dbaUpgrade php-commonUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-common-debuginfoUpgrade php-json-debuginfoUpgrade php-pdoUpgrade php-pecl-apcuUpgrade php-pecl-zip-debugsourceUpgrade php-intlUpgrade php-gmpUpgrade php-dba-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-ldapUpgrade php-fpm-debuginfoUpgrade php-dbgUpgrade php-pecl-zip-debuginfoUpgrade php-process-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-debuginfoUpgrade libzip-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pgsqlUpgrade php-xml-debuginfoUpgrade php-enchant-debuginfo | Oct 20, 2022 | Nov 19, 2020 |
| Debian | — | Upgrade php-pear | Nov 24, 2020 | Nov 19, 2020 |
| Drupal | — | Upgrade to drupal version 8.9.1Upgrade to drupal version 9.0.9Upgrade to drupal version 7.75Upgrade to drupal version 8.8.1 | Nov 27, 2020 | Nov 19, 2020 |
| Gentoo Linux | — | Upgrade dev-php/PEAR-Archive_Tar. | Jan 26, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-pear | Feb 22, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-pear | Jan 20, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-pear | Feb 2, 2021 | Nov 19, 2020 |
| Oracle Solaris | — | Upgrade web/php-74 to version 7.4.15-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/php-73 to version 7.3.27-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/php-80 to version 8.0.2-11.4.33.0.1.94.0 on Solaris 11.4 | Apr 21, 2021 | Nov 19, 2020 |
| Oracle_linux | — | Upgrade php-pecl-zipUpgrade libzipUpgrade php-pearUpgrade php-dbaUpgrade php-opcacheUpgrade php-enchantUpgrade php-pecl-xdebugUpgrade php-processUpgrade php-gmpUpgrade php-cliUpgrade php-pecl-rrdUpgrade php-soapUpgrade php-mbstringUpgrade php-pecl-apcu-develUpgrade libzip-toolsUpgrade php-pdoUpgrade php-gdUpgrade php-jsonUpgrade php-mysqlndUpgrade php-embeddedUpgrade php-xmlrpcUpgrade php-snmpUpgrade php-pgsqlUpgrade phpUpgrade php-xmlUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-ffiUpgrade php-dbgUpgrade php-intlUpgrade php-bcmathUpgrade php-ldapUpgrade php-develUpgrade php-fpmUpgrade apcu-panelUpgrade php-commonUpgrade libzip-devel | Sep 17, 2022 | Nov 19, 2020 |
| Redhat_linux | — | Upgrade php-gd-debuginfoUpgrade php-xmlrpcUpgrade php-ldap-debuginfoUpgrade libzip-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-pdoUpgrade php-pecl-zipUpgrade php-gmp-debuginfoUpgrade php-intlUpgrade php-embeddedUpgrade php-pdo-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-soapUpgrade php-debugsourceUpgrade php-dbaUpgrade php-gdUpgrade php-develUpgrade php-pecl-rrdUpgrade php-odbc-debuginfoUpgrade php-cli-debuginfoUpgrade php-processUpgrade php-process-debuginfoUpgrade php-jsonUpgrade php-intl-debuginfoUpgrade php-fpm-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-enchantUpgrade libzipUpgrade php-embedded-debuginfoUpgrade phpUpgrade php-pecl-apcu-debuginfoUpgrade php-gmpUpgrade php-pecl-apcu-develUpgrade php-dbg-debuginfoUpgrade php-snmp-debuginfoUpgrade php-pgsqlUpgrade php-bcmathUpgrade php-pecl-xdebug-debuginfoUpgrade php-ffi-debuginfoUpgrade php-mbstringUpgrade php-bcmath-debuginfoUpgrade php-opcache-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-fpmUpgrade libzip-develUpgrade php-pecl-xdebugNo solution existsUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-mysqlndUpgrade php-xml-debuginfoUpgrade php-dbgUpgrade php-commonUpgrade php-pearUpgrade php-soap-debuginfoUpgrade php-json-debuginfoUpgrade php-debuginfoUpgrade apcu-panelUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-dba-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-odbcUpgrade php-opcacheUpgrade libzip-toolsUpgrade php-snmpUpgrade libzip-debuginfoUpgrade php-cliUpgrade php-pecl-xdebug-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-xmlUpgrade php-enchant-debuginfoUpgrade php-ffi | Oct 20, 2022 | Nov 19, 2020 |
| Rocky_linux | — | Upgrade phpUpgrade php-embedded-debuginfoUpgrade php-intlUpgrade libzip-develUpgrade php-snmp-debuginfoUpgrade php-gd-debuginfoUpgrade php-ldap-debuginfoUpgrade php-mysqlndUpgrade php-embeddedUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-debuginfoUpgrade libzip-toolsUpgrade php-bcmath-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-gmp-debuginfoUpgrade php-enchantUpgrade php-opcacheUpgrade libzipUpgrade php-debugsourceUpgrade php-ldapUpgrade php-xmlUpgrade php-pgsql-debuginfoUpgrade php-snmpUpgrade php-dbgUpgrade php-ffiUpgrade php-process-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-cliUpgrade php-fpm-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-jsonUpgrade php-pecl-xdebugUpgrade php-opcache-debuginfoUpgrade php-processUpgrade php-pdo-debuginfoUpgrade php-odbc-debuginfoUpgrade php-mbstringUpgrade php-pdoUpgrade php-dbg-debuginfoUpgrade php-pgsqlUpgrade php-develUpgrade php-intl-debuginfoUpgrade php-enchant-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrdUpgrade php-odbcUpgrade php-commonUpgrade php-pecl-rrd-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-soapUpgrade php-json-debuginfoUpgrade php-common-debuginfoUpgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade libzip-debugsourceUpgrade php-gdUpgrade php-dba-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcuUpgrade php-gmpUpgrade php-fpmUpgrade php-dbaUpgrade php-cli-debuginfoUpgrade php-pecl-zip | Mar 12, 2024 | Nov 19, 2020 |
| Ubuntu | — | Upgrade php-pearUpgrade drupal7 (Ubuntu Pro) | Dec 2, 2020 | Nov 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub