In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-apcu-develUpgrade libzip-toolsUpgrade php-soapUpgrade php-pgsqlUpgrade php-opcacheUpgrade php-ldapUpgrade php-odbcUpgrade php-commonUpgrade php-dbaUpgrade php-dbgUpgrade php-embeddedUpgrade apcu-panelUpgrade php-intlUpgrade libzipUpgrade phpUpgrade php-snmpUpgrade php-gmpUpgrade php-processUpgrade php-gdUpgrade php-enchantUpgrade php-fpmUpgrade php-pearUpgrade php-jsonUpgrade php-mysqlndUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-bcmathUpgrade php-cliUpgrade php-pdoUpgrade php-pecl-zipUpgrade php-develUpgrade php-pecl-apcuUpgrade php-mbstringUpgrade php-xmlUpgrade libzip-devel | May 4, 2022 | Feb 21, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Feb 21, 2019 |
| Centos_linux | — | Upgrade php-mysqlnd-debuginfoUpgrade php-intl-debuginfoUpgrade php-gmpUpgrade php-process-debuginfoUpgrade php-json-debuginfoUpgrade php-jsonUpgrade libzip-toolsUpgrade php-dba-debuginfoUpgrade php-ldap-debuginfoUpgrade libzip-debugsourceUpgrade php-snmp-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-apcu-develUpgrade php-odbc-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-gdUpgrade php-pecl-zip-debugsourceUpgrade php-bcmathUpgrade php-pdo-debuginfoUpgrade php-debugsourceUpgrade php-intlUpgrade php-enchantUpgrade libzip-debuginfoUpgrade php-embeddedUpgrade php-dbaUpgrade php-fpm-debuginfoUpgrade php-pgsqlUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-processUpgrade php-xml-debuginfoUpgrade php-gd-debuginfoUpgrade libzipUpgrade php-cli-debuginfoUpgrade php-soapUpgrade php-pdoUpgrade php-xmlrpc-debuginfoUpgrade php-odbcUpgrade php-gmp-debuginfoUpgrade php-snmpUpgrade phpUpgrade php-pgsql-debuginfoUpgrade apcu-panelUpgrade php-pearUpgrade php-commonUpgrade php-enchant-debuginfoUpgrade php-dbgUpgrade php-common-debuginfoUpgrade php-mysqlndUpgrade php-mbstring-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-debuginfoUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-embedded-debuginfoUpgrade php-recode-debuginfoUpgrade php-mbstringUpgrade libzip-develUpgrade php-dbg-debuginfoUpgrade php-opcache-debuginfoUpgrade php-xmlUpgrade php-fpmUpgrade php-bcmath-debuginfoUpgrade php-cliUpgrade php-opcacheUpgrade php-soap-debuginfoUpgrade php-pecl-apcuUpgrade php-devel | Apr 29, 2020 | Feb 21, 2019 |
| Debian | — | Upgrade php7.3 | Feb 25, 2019 | Feb 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-ldapUpgrade php-odbcUpgrade php-recodeUpgrade php-cliUpgrade phpUpgrade php-pdoUpgrade php-gdUpgrade php-pgsqlUpgrade php-processUpgrade php-xmlUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-commonUpgrade php-soap | Apr 2, 2019 | Feb 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-pdoUpgrade php-recodeUpgrade php-cliUpgrade php-soapUpgrade phpUpgrade php-ldapUpgrade php-gdUpgrade php-processUpgrade php-commonUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-odbcUpgrade php-pgsqlUpgrade php-mysql | Mar 27, 2019 | Feb 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade php-xmlrpcUpgrade php-odbcUpgrade php-ldapUpgrade php-mysqlUpgrade php-pdoUpgrade php-xmlUpgrade php-cliUpgrade php-recodeUpgrade php-commonUpgrade php-soapUpgrade php-pgsqlUpgrade php-gdUpgrade php-processUpgrade php | Apr 3, 2019 | Feb 21, 2019 |
| Oracle_linux | — | Upgrade phpUpgrade php-mysqlndUpgrade php-cliUpgrade libzip-develUpgrade php-mbstringUpgrade libzip-toolsUpgrade php-opcacheUpgrade php-snmpUpgrade php-pecl-apcuUpgrade php-xmlUpgrade apcu-panelUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-dbgUpgrade php-pearUpgrade php-odbcUpgrade php-commonUpgrade php-dbaUpgrade php-enchantUpgrade php-pdoUpgrade php-gmpUpgrade php-pgsqlUpgrade php-embeddedUpgrade php-gdUpgrade php-fpmUpgrade php-develUpgrade php-bcmathUpgrade php-pecl-apcu-develUpgrade php-soapUpgrade php-ldapUpgrade php-intlUpgrade libzipUpgrade php-jsonUpgrade php-pecl-zipUpgrade php-process | Jul 22, 2024 | Nov 12, 2018 |
| Php | — | Upgrade to PHP version 5.6.39Upgrade to PHP version 7.2.13Upgrade to PHP version 7.1.25 | Feb 25, 2019 | Feb 21, 2019 |
| Redhat_linux | — | Upgrade php-snmp-debuginfoUpgrade php-pdo-debuginfoUpgrade php-xmlUpgrade php-pearUpgrade php-pecl-zip-debugsourceUpgrade php-snmpUpgrade php-cli-debuginfoUpgrade libzip-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-mbstringUpgrade php-fpm-debuginfoUpgrade php-debuginfoUpgrade php-xmlrpcUpgrade php-intl-debuginfoNo solution existsUpgrade php-commonUpgrade php-dbgUpgrade php-odbc-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-ldap-debuginfoUpgrade php-opcache-debuginfoUpgrade php-common-debuginfoUpgrade php-soap-debuginfoUpgrade libzip-toolsUpgrade php-bcmath-debuginfoUpgrade libzip-develUpgrade php-dba-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-odbcUpgrade php-xml-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-json-debuginfoUpgrade php-pgsqlUpgrade php-enchant-debuginfoUpgrade php-process-debuginfoUpgrade php-dbaUpgrade libzip-debugsourceUpgrade php-dbg-debuginfoUpgrade phpUpgrade php-gmp-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade libzipUpgrade php-intlUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcuUpgrade php-bcmathUpgrade php-fpmUpgrade php-embedded-debuginfoUpgrade php-debugsourceUpgrade php-jsonUpgrade php-enchantUpgrade php-ldapUpgrade php-opcacheUpgrade php-embeddedUpgrade php-gdUpgrade php-xmlrpc-debuginfoUpgrade php-pdoUpgrade php-recodeUpgrade php-soapUpgrade php-mysqlndUpgrade apcu-panelUpgrade php-cliUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-processUpgrade php-gd-debuginfoUpgrade php-recode-debuginfoUpgrade php-pecl-zipUpgrade php-develUpgrade libzip-tools-debuginfo | Apr 29, 2020 | Feb 21, 2019 |
| Rocky_linux | — | Upgrade php-intlUpgrade php-pdoUpgrade php-pecl-zip-debuginfoUpgrade php-soapUpgrade php-pgsqlUpgrade php-pecl-apcu-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dba-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-dbaUpgrade php-bcmathUpgrade libzipUpgrade php-commonUpgrade php-pdo-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-dbgUpgrade php-xml-debuginfoUpgrade libzip-toolsUpgrade php-gmpUpgrade libzip-debuginfoUpgrade php-jsonUpgrade php-pecl-zip-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-pecl-zipUpgrade php-ldap-debuginfoUpgrade libzip-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-odbcUpgrade php-mysqlnd-debuginfoUpgrade php-process-debuginfoUpgrade php-snmp-debuginfoUpgrade php-cli-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-apcu-develUpgrade php-gdUpgrade php-ldapUpgrade php-fpm-debuginfoUpgrade php-pecl-apcuUpgrade php-develUpgrade php-recodeUpgrade php-debuginfoUpgrade php-embeddedUpgrade php-pecl-apcu-debuginfoUpgrade php-snmpUpgrade php-dbg-debuginfoUpgrade php-cliUpgrade php-recode-debuginfoUpgrade php-xmlrpcUpgrade php-enchantUpgrade php-enchant-debuginfoUpgrade php-debugsourceUpgrade php-opcache-debuginfoUpgrade php-mbstringUpgrade php-intl-debuginfoUpgrade php-fpmUpgrade php-gd-debuginfoUpgrade libzip-develUpgrade php-processUpgrade php-opcacheUpgrade phpUpgrade php-soap-debuginfoUpgrade php-embedded-debuginfoUpgrade php-xmlUpgrade php-mysqlndUpgrade php-common-debuginfo | Mar 12, 2024 | Feb 21, 2019 |
| Suse | — | Upgrade php72-zlibUpgrade php7-readlineUpgrade php72-pdoUpgrade php72-xslUpgrade php53-fileinfoUpgrade php7-pdoUpgrade php5-socketsUpgrade php72-bcmathUpgrade php7-fpmUpgrade php72-shmopUpgrade php53-calendarUpgrade php7-bcmathUpgrade php5-pharUpgrade php53-develUpgrade php7-xslUpgrade php53-sysvsemUpgrade php72-zipUpgrade php7-gettextUpgrade php53-imapUpgrade php53-socketsUpgrade php5-iconvUpgrade php7-wddxUpgrade php7-exifUpgrade php53-ctypeUpgrade libmemcached11Upgrade php5-ftpUpgrade php7-opensslUpgrade php72-xmlreaderUpgrade php53-wddxUpgrade php7-sysvmsgUpgrade php53-gdUpgrade php53-odbcUpgrade php7-imapUpgrade apache2-mod_php7Upgrade php5-pdoUpgrade php7-posixUpgrade php53-iconvUpgrade php7-mcryptUpgrade php53-sysvmsgUpgrade php5-domUpgrade php72-odbcUpgrade php5Upgrade php7-tokenizerUpgrade php72-readlineUpgrade php5-sysvsemUpgrade php53-jsonUpgrade php7-domUpgrade php5-xmlreaderUpgrade php7-gmpUpgrade php53-sysvshmUpgrade php5-develUpgrade php5-gettextUpgrade php5-pearUpgrade php53-pdoUpgrade php7-dbaUpgrade php5-suhosinUpgrade php72-bz2Upgrade php53-suhosinUpgrade php72-tokenizerUpgrade php5-gmpUpgrade libmemcachedutil2Upgrade php72Upgrade php7Upgrade php5-ldapUpgrade php72-curlUpgrade php53-readlineUpgrade php5-wddxUpgrade php7-xmlreaderUpgrade php7-enchantUpgrade php53-ftpUpgrade php72-xmlwriterUpgrade php7-mbstringUpgrade php5-mysqlUpgrade php5-bcmathUpgrade php7-intlUpgrade php72-mysqlUpgrade php5-xmlrpcUpgrade php7-soapUpgrade php7-tidyUpgrade php7-jsonUpgrade php7-snmpUpgrade php7-xmlwriterUpgrade php72-pearUpgrade php5-xslUpgrade php53-shmopUpgrade php7-xmlrpcUpgrade php53-tidyUpgrade libtidy-0_99-0-develUpgrade libmemcachedUpgrade php5-imapUpgrade php5-opensslUpgrade php7-pcntlUpgrade php7-fileinfoUpgrade php7-ctypeUpgrade php72-pear-archive_tarUpgrade php53-xmlwriterUpgrade php5-bz2Upgrade php53-xmlreaderUpgrade php5-curlUpgrade php5-pspellUpgrade php5-posixUpgrade php5-fileinfoUpgrade php72-imapUpgrade apache2-mod_php5Upgrade php5-calendarUpgrade php5-pcntlUpgrade php72-soapUpgrade php53-pearUpgrade php53-snmpUpgrade php7-mysqlUpgrade apache2-mod_php53Upgrade tidyUpgrade php7-sqliteUpgrade php5-mbstringUpgrade php53Upgrade php72-memcachedUpgrade php7-odbcUpgrade php7-shmopUpgrade php72-mbstringUpgrade php72-sysvsemUpgrade php72-ftpUpgrade php5-zlibUpgrade php5-xmlwriterUpgrade php5-sysvshmUpgrade php7-sysvsemUpgrade php72-intlUpgrade php72-ldapUpgrade php5-pgsqlUpgrade php53-tokenizerUpgrade php72-calendarUpgrade php7-zlibUpgrade php72-opcacheUpgrade php72-jsonUpgrade php72-wddxUpgrade php53-gettextUpgrade php7-bz2Upgrade php72-dbaUpgrade php53-xmlrpcUpgrade php7-firebirdUpgrade php72-socketsUpgrade php72-sysvshmUpgrade php5-snmpUpgrade php72-enchantUpgrade php53-mysqlUpgrade php7-develUpgrade php72-xmlrpcUpgrade php53-zipUpgrade php72-tidyUpgrade php72-pcntlUpgrade php7-fastcgiUpgrade php72-posixUpgrade php5-soapUpgrade php7-pearUpgrade php7-sodiumUpgrade php53-dbaUpgrade php53-pgsqlUpgrade php53-pspellUpgrade php7-pspellUpgrade php53-opensslUpgrade php5-sqliteUpgrade php53-pcntlUpgrade php72-iconvUpgrade php7-ldapUpgrade php7-testresultsUpgrade php72-ctypeUpgrade php72-pharUpgrade php53-zlibUpgrade php7-socketsUpgrade php7-sysvshmUpgrade php5-exifUpgrade php72-opensslUpgrade apache2-mod_php72Upgrade php53-bcmathUpgrade php72-gmpUpgrade php5-fpmUpgrade php53-bz2Upgrade php53-exifUpgrade php72-gdUpgrade php5-odbcUpgrade php5-enchantUpgrade php7-iconvUpgrade php53-fastcgiUpgrade php72-gettextUpgrade php5-ctypeUpgrade php5-tokenizerUpgrade php5-gdUpgrade php53-domUpgrade php7-opcacheUpgrade php7-pear-archive_tarUpgrade libtidy-0_99-0Upgrade php7-zipUpgrade php72-exifUpgrade php5-shmopUpgrade php5-opcacheUpgrade php53-posixUpgrade php7-calendarUpgrade php5-dbaUpgrade php53-xslUpgrade php72-develUpgrade php53-gmpUpgrade php53-intl | Apr 6, 2019 | Feb 21, 2019 |
| Ubuntu | — | Upgrade php5-cli (Ubuntu Pro)Upgrade php5-fpmUpgrade php5-cgiUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cgi (Ubuntu Pro)Upgrade php5-cliUpgrade php5-fpm (Ubuntu Pro)Upgrade libapache2-mod-php5 | May 23, 2019 | Feb 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub