In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-gdUpgrade php-recodeUpgrade php-fpmUpgrade php-pecl-zipUpgrade php-pecl-apcuUpgrade php-mbstringUpgrade php-enchantUpgrade php-pearUpgrade php-mysqlndUpgrade php-xmlUpgrade libzip-develUpgrade php-pdoUpgrade php-gmpUpgrade php-snmpUpgrade php-xmlrpcUpgrade php-processUpgrade php-bcmathUpgrade php-jsonUpgrade php-cliUpgrade php-develUpgrade php-opcacheUpgrade apcu-panelUpgrade php-dbgUpgrade libzipUpgrade php-pgsqlUpgrade php-commonUpgrade php-embeddedUpgrade php-soapUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade phpUpgrade libzip-toolsUpgrade php-odbcUpgrade php-intlUpgrade php-ldap | May 4, 2022 | Feb 21, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Feb 21, 2019 |
| Centos_linux | — | Upgrade php-xmlrpcUpgrade php-opcacheUpgrade php-mysqlndUpgrade php-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-embedded-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pgsql-debuginfoUpgrade apcu-panelUpgrade php-dbgUpgrade php-gmp-debuginfoUpgrade php-pecl-apcuUpgrade php-recodeUpgrade php-mbstring-debuginfoUpgrade php-snmpUpgrade php-pearUpgrade php-commonUpgrade php-mbstringUpgrade php-bcmath-debuginfoUpgrade php-fpmUpgrade phpUpgrade php-ldapUpgrade php-recode-debuginfoUpgrade php-soap-debuginfoUpgrade php-develUpgrade libzip-develUpgrade php-opcache-debuginfoUpgrade php-common-debuginfoUpgrade php-cliUpgrade php-xmlUpgrade php-gmpUpgrade php-pdoUpgrade php-pecl-zipUpgrade php-xml-debuginfoUpgrade php-pgsqlUpgrade php-intl-debuginfoUpgrade php-dba-debuginfoUpgrade libzip-debuginfoUpgrade php-cli-debuginfoUpgrade php-intlUpgrade php-jsonUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-develUpgrade php-debugsourceUpgrade php-embeddedUpgrade php-gd-debuginfoUpgrade php-processUpgrade php-pecl-apcu-debugsourceUpgrade php-fpm-debuginfoUpgrade php-dbaUpgrade php-odbc-debuginfoUpgrade libzip-toolsUpgrade php-pecl-apcu-debuginfoUpgrade php-bcmathUpgrade php-ldap-debuginfoUpgrade libzip-debugsourceUpgrade php-soapUpgrade php-mysqlnd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-process-debuginfoUpgrade php-json-debuginfoUpgrade php-gdUpgrade php-odbcUpgrade php-snmp-debuginfoUpgrade libzipUpgrade php-enchantUpgrade libzip-tools-debuginfo | Apr 29, 2020 | Feb 21, 2019 |
| Debian | — | Upgrade php7.3 | Feb 25, 2019 | Feb 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-recodeUpgrade php-pdoUpgrade php-cliUpgrade phpUpgrade php-gdUpgrade php-ldapUpgrade php-odbcUpgrade php-pgsqlUpgrade php-commonUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-processUpgrade php-soapUpgrade php-mysql | Apr 2, 2019 | Feb 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-ldapUpgrade php-processUpgrade php-cliUpgrade php-recodeUpgrade php-soapUpgrade php-pdoUpgrade php-gdUpgrade phpUpgrade php-xmlUpgrade php-commonUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-odbcUpgrade php-pgsql | Mar 27, 2019 | Feb 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade php-soapUpgrade php-pgsqlUpgrade php-gdUpgrade php-processUpgrade phpUpgrade php-ldapUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-cliUpgrade php-odbcUpgrade php-commonUpgrade php-xmlUpgrade php-mysql | Apr 3, 2019 | Feb 21, 2019 |
| Oracle_linux | — | Upgrade php-dbgUpgrade php-pecl-apcuUpgrade libzip-toolsUpgrade apcu-panelUpgrade php-odbcUpgrade php-xmlUpgrade php-opcacheUpgrade php-cliUpgrade phpUpgrade php-mysqlndUpgrade php-xmlrpcUpgrade php-snmpUpgrade php-recodeUpgrade php-commonUpgrade php-pearUpgrade php-mbstringUpgrade libzip-develUpgrade php-fpmUpgrade php-gdUpgrade php-embeddedUpgrade php-processUpgrade php-gmpUpgrade php-dbaUpgrade php-develUpgrade libzipUpgrade php-pecl-apcu-develUpgrade php-bcmathUpgrade php-ldapUpgrade php-pdoUpgrade php-soapUpgrade php-intlUpgrade php-enchantUpgrade php-pgsqlUpgrade php-pecl-zipUpgrade php-json | Jul 22, 2024 | Nov 12, 2018 |
| Php | — | Upgrade to PHP version 7.1.25Upgrade to PHP version 5.6.39Upgrade to PHP version 7.2.13 | Feb 25, 2019 | Feb 21, 2019 |
| Redhat_linux | — | Upgrade php-pecl-zipUpgrade php-embedded-debuginfoUpgrade php-cliUpgrade php-opcacheUpgrade php-ldapUpgrade phpUpgrade php-pgsql-debuginfoUpgrade php-enchantUpgrade php-pecl-apcu-develUpgrade php-processUpgrade php-gdUpgrade php-embeddedUpgrade libzip-tools-debuginfoUpgrade php-process-debuginfoUpgrade php-develUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-gmp-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade libzipUpgrade php-dbg-debuginfoUpgrade php-recode-debuginfoUpgrade php-soapUpgrade php-gd-debuginfoUpgrade php-recodeUpgrade php-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-intlUpgrade php-dbaUpgrade php-gmpUpgrade php-pdoUpgrade php-pecl-apcuUpgrade php-fpmUpgrade libzip-debugsourceUpgrade php-jsonUpgrade php-bcmathUpgrade php-commonUpgrade php-pdo-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-xmlUpgrade php-fpm-debuginfoNo solution existsUpgrade php-soap-debuginfoUpgrade php-common-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pgsqlUpgrade php-odbc-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-json-debuginfoUpgrade php-dbgUpgrade php-intl-debuginfoUpgrade php-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade libzip-debuginfoUpgrade php-xmlrpcUpgrade php-bcmath-debuginfoUpgrade php-pearUpgrade php-xml-debuginfoUpgrade php-snmp-debuginfoUpgrade php-odbcUpgrade php-snmpUpgrade php-cli-debuginfoUpgrade libzip-toolsUpgrade libzip-develUpgrade php-dba-debuginfoUpgrade php-mbstring | Apr 29, 2020 | Feb 21, 2019 |
| Rocky_linux | — | Upgrade php-develUpgrade php-common-debuginfoUpgrade php-gd-debuginfoUpgrade php-processUpgrade php-opcacheUpgrade php-snmpUpgrade php-fpmUpgrade php-enchant-debuginfoUpgrade php-debugsourceUpgrade php-pecl-apcuUpgrade php-mbstringUpgrade php-mysqlndUpgrade php-recodeUpgrade php-embeddedUpgrade php-opcache-debuginfoUpgrade php-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-intl-debuginfoUpgrade php-xmlrpcUpgrade php-enchantUpgrade php-embedded-debuginfoUpgrade php-cliUpgrade libzip-develUpgrade phpUpgrade php-xmlUpgrade php-dbg-debuginfoUpgrade php-soap-debuginfoUpgrade php-recode-debuginfoUpgrade php-ldapUpgrade php-pecl-zip-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pdo-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-odbcUpgrade php-mysqlnd-debuginfoUpgrade libzip-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-gmp-debuginfoUpgrade php-odbc-debuginfoUpgrade php-xml-debuginfoUpgrade php-soapUpgrade php-snmp-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-intlUpgrade php-ldap-debuginfoUpgrade libzipUpgrade php-bcmathUpgrade php-dbaUpgrade php-commonUpgrade php-pgsql-debuginfoUpgrade php-dbgUpgrade php-cli-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-fpm-debuginfoUpgrade php-dba-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-gdUpgrade php-pgsqlUpgrade php-json-debuginfoUpgrade libzip-debuginfoUpgrade php-jsonUpgrade php-gmpUpgrade libzip-toolsUpgrade php-pecl-zip | Mar 12, 2024 | Feb 21, 2019 |
| Suse | — | Upgrade php7-zlibUpgrade php53-posixUpgrade php5-odbcUpgrade php72-ldapUpgrade php5-xmlwriterUpgrade php72-sysvshmUpgrade php53-gmpUpgrade php5-dbaUpgrade php72-sysvsemUpgrade php7-fastcgiUpgrade php53-snmpUpgrade php72-soapUpgrade php7-mysqlUpgrade php7-opcacheUpgrade php53-exifUpgrade php53-domUpgrade php53-xmlrpcUpgrade php7-pspellUpgrade php72-pcntlUpgrade php7-develUpgrade php72-exifUpgrade php7-pear-archive_tarUpgrade php53-bz2Upgrade php5-fpmUpgrade php72-ctypeUpgrade php7-ctypeUpgrade php5-enchantUpgrade php72-tidyUpgrade php72-calendarUpgrade php5-sysvshmUpgrade php53-xmlreaderUpgrade apache2-mod_php5Upgrade php72-develUpgrade php53-intlUpgrade php5-bz2Upgrade php5-shmopUpgrade php53-xmlwriterUpgrade php72-pharUpgrade php7-testresultsUpgrade php72-iconvUpgrade php7-pearUpgrade php7-firebirdUpgrade libtidy-0_99-0Upgrade php7-ldapUpgrade php7-sysvshmUpgrade php72-opensslUpgrade php5-fileinfoUpgrade php72-memcachedUpgrade php72-gmpUpgrade php53-fastcgiUpgrade php7-sqliteUpgrade php72-jsonUpgrade php53-bcmathUpgrade php53-gettextUpgrade php7-bz2Upgrade php72-posixUpgrade php72-enchantUpgrade php5-gdUpgrade php5-snmpUpgrade php72-socketsUpgrade php72-ftpUpgrade php7-zipUpgrade php5-zlibUpgrade php53-opensslUpgrade php72-opcacheUpgrade php7-iconvUpgrade php72-intlUpgrade php53-tokenizerUpgrade php53-xslUpgrade php72-dbaUpgrade php72-zlibUpgrade php7-xmlwriterUpgrade php7-pdoUpgrade php53-ldapUpgrade php5-mcryptUpgrade php72-fastcgiUpgrade php7-tokenizerUpgrade php72-pgsqlUpgrade php72-sysvmsgUpgrade php53-pdoUpgrade php53-imapUpgrade php7-gettextUpgrade php53-socketsUpgrade php53-wddxUpgrade php7-exifUpgrade php5-iconvUpgrade php7-sysvmsgUpgrade php72-xmlreaderUpgrade php72-xslUpgrade php53-readlineUpgrade php5-domUpgrade php7-dbaUpgrade php5-ftpUpgrade php7-wddxUpgrade php7-opensslUpgrade libmemcached11Upgrade php5-gmpUpgrade php53-iconvUpgrade php7Upgrade php5-pdoUpgrade php53-sysvsemUpgrade php53-suhosinUpgrade php5-ldapUpgrade php7-gmpUpgrade libmemcachedutil2Upgrade php72-zipUpgrade php53-ctypeUpgrade php72-bz2Upgrade php72-tokenizerUpgrade php72-shmopUpgrade php5-zipUpgrade libmemcached-develUpgrade php53-shmopUpgrade php7-jsonUpgrade php5-xslUpgrade libtidy-0_99-0-develUpgrade php5-sysvsemUpgrade php53-soapUpgrade php5-intlUpgrade php72-pearUpgrade php53-calendarUpgrade php7-domUpgrade php7-fpmUpgrade php7-bcmathUpgrade php72-pdoUpgrade php7-snmpUpgrade php5Upgrade php5-fastcgiUpgrade php53-tidyUpgrade php5-develUpgrade libmemcachedUpgrade php5-gettextUpgrade php53-sysvshmUpgrade php7-xmlrpcUpgrade php72-snmpUpgrade php7-mcryptUpgrade php7-gdUpgrade php7-soapUpgrade php53-jsonUpgrade php72-fpmUpgrade php5-wddxUpgrade php5-bcmathUpgrade php72-xmlwriterUpgrade php5-pearUpgrade php72-curlUpgrade php72-pspellUpgrade php53-odbcUpgrade php7-fileinfoUpgrade php7-mbstringUpgrade php7-xmlreaderUpgrade php5-sysvmsgUpgrade php5-socketsUpgrade php53-mcryptUpgrade php53-gdUpgrade php7-imapUpgrade php5-xmlrpcUpgrade php7-pharUpgrade php7-embedUpgrade php7-pcntlUpgrade php5-jsonUpgrade php53-develUpgrade php5-pharUpgrade php7-posixUpgrade php72-readlineUpgrade apache2-mod_php7Upgrade php7-curlUpgrade php7-intlUpgrade php53-ftpUpgrade php7-enchantUpgrade php7-tidyUpgrade php72-sqliteUpgrade php5-imapUpgrade php72-fileinfoUpgrade php53-sqliteUpgrade php5-mysqlUpgrade php72-odbcUpgrade php7-xslUpgrade php5-suhosinUpgrade php72Upgrade php7-pgsqlUpgrade php53-sysvmsgUpgrade php53-mbstringUpgrade php7-ftpUpgrade php53-curlUpgrade php5-opensslUpgrade php5-xmlreaderUpgrade php72-domUpgrade php72-mysqlUpgrade php53-fileinfoUpgrade php72-bcmathUpgrade php7-readline | Apr 6, 2019 | Feb 21, 2019 |
| Ubuntu | — | Upgrade php5-cliUpgrade php5-fpm (Ubuntu Pro)Upgrade php5-cgi (Ubuntu Pro)Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade php5-fpmUpgrade php5-cgiUpgrade php5-cli (Ubuntu Pro) | May 23, 2019 | Feb 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub