An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-gmpUpgrade php-soapUpgrade php-commonUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-pdoUpgrade php-mbstringUpgrade php-odbcUpgrade php-intlUpgrade php-develUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-dbgUpgrade php-jsonUpgrade php-pgsqlUpgrade libzip-develUpgrade php-mysqlndUpgrade php-recodeUpgrade php-snmpUpgrade php-opcacheUpgrade php-xmlUpgrade php-pearUpgrade libzip-toolsUpgrade php-gdUpgrade php-bcmathUpgrade php-processUpgrade php-embeddedUpgrade php-cliUpgrade php-pecl-zipUpgrade libzipUpgrade php-xmlrpcUpgrade php-enchantUpgrade apcu-panelUpgrade phpUpgrade php-fpm | May 4, 2022 | Feb 22, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Feb 22, 2019 |
| Centos_linux | — | Upgrade libzipUpgrade libzip-develUpgrade php-gdUpgrade php-bcmath-debuginfoUpgrade php-dbg-debuginfoUpgrade php-gd-debuginfoUpgrade php-mysqlndUpgrade php-intlUpgrade php-processUpgrade phpUpgrade php-pecl-zipUpgrade php-soapUpgrade php-pdoUpgrade libzip-tools-debuginfoUpgrade php-soap-debuginfoUpgrade php-cliUpgrade php-embeddedUpgrade php-xmlrpc-debuginfoUpgrade php-snmpUpgrade php-ldapUpgrade php-bcmathUpgrade php-recode-debuginfoUpgrade libzip-toolsUpgrade libzip-debugsourceUpgrade php-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-xmlUpgrade php-recodeUpgrade apcu-panelUpgrade php-opcacheUpgrade php-pgsql-debuginfoUpgrade php-gmp-debuginfoUpgrade php-enchantUpgrade php-embedded-debuginfoUpgrade php-dbaUpgrade php-xmlrpcUpgrade php-mysqlnd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-odbcUpgrade php-opcache-debuginfoUpgrade php-enchant-debuginfoUpgrade php-fpmUpgrade php-intl-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-jsonUpgrade php-snmp-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-apcuUpgrade php-commonUpgrade php-fpm-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pearUpgrade php-mbstringUpgrade php-pdo-debuginfoUpgrade php-develUpgrade php-process-debuginfoUpgrade php-pecl-apcu-develUpgrade php-xml-debuginfoUpgrade php-gmpUpgrade php-pgsqlUpgrade libzip-debuginfoUpgrade php-dbgUpgrade php-debuginfoUpgrade php-json-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dba-debuginfoUpgrade php-common-debuginfo | Apr 29, 2020 | Feb 22, 2019 |
| Debian | — | Upgrade php7.3 | Feb 25, 2019 | Feb 22, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-soapUpgrade php-commonUpgrade php-pgsqlUpgrade phpUpgrade php-ldapUpgrade php-odbcUpgrade php-mysqlUpgrade php-gdUpgrade php-recodeUpgrade php-processUpgrade php-pdoUpgrade php-xmlUpgrade php-cliUpgrade php-xmlrpc | Apr 2, 2019 | Feb 22, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade phpUpgrade php-processUpgrade php-commonUpgrade php-xmlUpgrade php-recodeUpgrade php-cliUpgrade php-xmlrpcUpgrade php-odbcUpgrade php-pdoUpgrade php-mysqlUpgrade php-gdUpgrade php-soapUpgrade php-ldapUpgrade php-pgsql | Mar 27, 2019 | Feb 22, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade php-commonUpgrade php-pgsqlUpgrade php-xmlUpgrade php-odbcUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-pdoUpgrade php-recodeUpgrade php-soapUpgrade php-gdUpgrade php-processUpgrade phpUpgrade php-cli | Apr 3, 2019 | Feb 22, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Feb 22, 2019 |
| Oracle_linux | — | Upgrade apcu-panelUpgrade php-dbaUpgrade php-jsonUpgrade php-bcmathUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade php-commonUpgrade php-dbgUpgrade php-soapUpgrade libzip-toolsUpgrade php-pecl-apcuUpgrade php-pdoUpgrade php-gmpUpgrade php-odbcUpgrade php-pecl-zipUpgrade php-intlUpgrade php-ldapUpgrade php-develUpgrade php-cliUpgrade phpUpgrade php-mysqlndUpgrade php-pearUpgrade php-snmpUpgrade php-enchantUpgrade php-fpmUpgrade php-processUpgrade php-gdUpgrade php-recodeUpgrade php-mbstringUpgrade php-xmlrpcUpgrade libzipUpgrade php-opcacheUpgrade php-xmlUpgrade php-embeddedUpgrade libzip-devel | Jul 22, 2024 | Dec 6, 2018 |
| Php | — | Upgrade to PHP version 7.2.14Upgrade to PHP version 7.3.1Upgrade to PHP version 5.6.40 | Feb 27, 2019 | Feb 22, 2019 |
| Redhat_linux | — | Upgrade php-json-debuginfoUpgrade apcu-panelUpgrade php-dbaUpgrade php-intlUpgrade php-process-debuginfoUpgrade phpUpgrade php-odbcUpgrade php-snmp-debuginfoUpgrade php-xmlUpgrade php-bcmath-debuginfoUpgrade php-processUpgrade php-soap-debuginfoUpgrade libzip-debugsourceUpgrade php-opcache-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-common-debuginfoUpgrade php-dba-debuginfoUpgrade libzip-debuginfoUpgrade php-intl-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-opcacheUpgrade php-dbg-debuginfoUpgrade php-cliUpgrade php-snmpUpgrade php-commonUpgrade php-mysqlndUpgrade libzip-toolsUpgrade php-recodeUpgrade php-fpm-debuginfoUpgrade libzip-develUpgrade php-mbstringUpgrade php-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-recode-debuginfoUpgrade php-pecl-apcu-develUpgrade php-dbgNo solution existsUpgrade php-debugsourceUpgrade php-enchantUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-develUpgrade php-pecl-zip-debugsourceUpgrade php-bcmathUpgrade libzipUpgrade php-embeddedUpgrade php-pecl-apcu-debugsourceUpgrade php-pdo-debuginfoUpgrade php-gmpUpgrade libzip-tools-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pearUpgrade php-soapUpgrade php-pecl-zipUpgrade php-xml-debuginfoUpgrade php-jsonUpgrade php-pgsqlUpgrade php-embedded-debuginfoUpgrade php-gmp-debuginfoUpgrade php-gd-debuginfoUpgrade php-ldapUpgrade php-fpmUpgrade php-gdUpgrade php-enchant-debuginfoUpgrade php-pecl-apcuUpgrade php-pdoUpgrade php-cli-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-apcu-debuginfo | Apr 29, 2020 | Feb 22, 2019 |
| Rocky_linux | — | Upgrade php-embedded-debuginfoUpgrade php-snmpUpgrade php-enchantUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-recodeUpgrade php-bcmath-debuginfoUpgrade php-xmlUpgrade php-debugsourceUpgrade php-gd-debuginfoUpgrade php-intl-debuginfoUpgrade php-recode-debuginfoUpgrade libzipUpgrade phpUpgrade php-debuginfoUpgrade php-embeddedUpgrade php-xmlrpcUpgrade libzip-develUpgrade php-processUpgrade php-cliUpgrade php-mysqlndUpgrade libzip-toolsUpgrade php-gdUpgrade php-enchant-debuginfoUpgrade php-fpmUpgrade php-pecl-apcuUpgrade php-dbg-debuginfoUpgrade php-gmp-debuginfoUpgrade php-soap-debuginfoUpgrade php-opcacheUpgrade php-ldap-debuginfoUpgrade libzip-debugsourceUpgrade php-dbgUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pdo-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dbaUpgrade php-common-debuginfoUpgrade php-pecl-zipUpgrade php-xml-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-develUpgrade php-intlUpgrade php-bcmathUpgrade php-pecl-apcu-debugsourceUpgrade php-dba-debuginfoUpgrade php-commonUpgrade php-cli-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-opcache-debuginfoUpgrade php-pdoUpgrade php-ldapUpgrade php-json-debuginfoUpgrade php-gmpUpgrade php-fpm-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-soapUpgrade php-snmp-debuginfoUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade libzip-tools-debuginfoUpgrade php-odbcUpgrade php-process-debuginfoUpgrade php-mbstringUpgrade php-json | Mar 12, 2024 | Feb 22, 2019 |
| Suse | — | Upgrade php5-pharUpgrade libtidy-0_99-0-develUpgrade php5-pcntlUpgrade php7-exifUpgrade php72-fileinfoUpgrade libmemcachedUpgrade php72-snmpUpgrade php5-gmpUpgrade php5-pearUpgrade php72-zlibUpgrade php72-shmopUpgrade php5-snmpUpgrade php72-tokenizerUpgrade php5-xmlwriterUpgrade php72-sysvmsgUpgrade php5-bcmathUpgrade php7-firebirdUpgrade php72-mysqlUpgrade php7-xmlreaderUpgrade php7-tidyUpgrade php72Upgrade php72-exifUpgrade php53-tidyUpgrade php53-wddxUpgrade php7-gettextUpgrade php7-imapUpgrade php72-curlUpgrade php7-gmpUpgrade php72-pearUpgrade php53-mcryptUpgrade php7Upgrade php53-shmopUpgrade php53-sqliteUpgrade php7-bz2Upgrade php53-pgsqlUpgrade php5-fastcgiUpgrade php5-opensslUpgrade php7-gdUpgrade php7-xslUpgrade php7-pcntlUpgrade php53-sysvsemUpgrade php72-xmlwriterUpgrade apache2-mod_php5Upgrade php72-odbcUpgrade php72-xslUpgrade php53-odbcUpgrade php72-posixUpgrade php5-xmlreaderUpgrade php5-ftpUpgrade php5-sysvmsgUpgrade php72-sysvshmUpgrade php53-soapUpgrade php7-intlUpgrade php7-opensslUpgrade php7-fpmUpgrade php7-posixUpgrade php53-readlineUpgrade php53-sysvmsgUpgrade php7-domUpgrade apache2-mod_php7Upgrade php53-posixUpgrade php7-xmlrpcUpgrade php72-fpmUpgrade php53-socketsUpgrade php72-pdoUpgrade php5-develUpgrade php53-zlibUpgrade php5-bz2Upgrade php72-sqliteUpgrade php53-bcmathUpgrade php72-zipUpgrade php7-pdoUpgrade php5-jsonUpgrade php7-mbstringUpgrade php7-ftpUpgrade php5-xslUpgrade php7-soapUpgrade php7-jsonUpgrade php53-suhosinUpgrade php53-imapUpgrade php7-iconvUpgrade php72-imapUpgrade php72-xmlrpcUpgrade php72-domUpgrade php53-snmpUpgrade php5-sysvsemUpgrade php53-pdoUpgrade php5-zipUpgrade php53-fileinfoUpgrade php5-mysqlUpgrade php72-xmlreaderUpgrade php5Upgrade php7-embedUpgrade php53-ctypeUpgrade php72-pgsqlUpgrade php53-iconvUpgrade php72-bcmathUpgrade php5-wddxUpgrade php53-ldapUpgrade php5-socketsUpgrade php53-mbstringUpgrade libmemcached-develUpgrade php5-calendarUpgrade php5-pdoUpgrade php53-zipUpgrade php53-gdUpgrade php53-ftpUpgrade php72-readlineUpgrade php53-gettextUpgrade php72-bz2Upgrade php7-sysvmsgUpgrade php5-gettextUpgrade php7-curlUpgrade php53-calendarUpgrade php5-mcryptUpgrade php5-soapUpgrade php5-xmlrpcUpgrade php53-sysvshmUpgrade php5-imapUpgrade php72-sysvsemUpgrade php7-sodiumUpgrade php53-curlUpgrade php7-pgsqlUpgrade php53-xmlreaderUpgrade php5-ctypeUpgrade php5-exifUpgrade php53-intlUpgrade php53-develUpgrade php5-sysvshmUpgrade php53-xmlrpcUpgrade php7-sysvshmUpgrade php5-suhosinUpgrade php72-pear-archive_tarUpgrade php53-mysqlUpgrade php5-sqliteUpgrade php5-posixUpgrade php7-dbaUpgrade php7-wddxUpgrade php7-readlineUpgrade php72-gettextUpgrade php7-develUpgrade php72-pharUpgrade php5-fileinfoUpgrade php72-ctypeUpgrade php72-gdUpgrade php72-opcacheUpgrade php53-domUpgrade php7-mcryptUpgrade php5-domUpgrade php5-mbstringUpgrade libtidy-0_99-0Upgrade php5-ldapUpgrade php72-ldapUpgrade php7-zipUpgrade php5-shmopUpgrade php72-socketsUpgrade php72-soapUpgrade php7-ldapUpgrade php7-xmlwriterUpgrade php7-odbcUpgrade php7-calendarUpgrade php53-pspellUpgrade php5-pgsqlUpgrade php72-opensslUpgrade apache2-mod_php53Upgrade php5-iconvUpgrade php53-pearUpgrade php72-iconvUpgrade php7-snmpUpgrade php53-dbaUpgrade php7-sqliteUpgrade php7-pharUpgrade php53-fastcgiUpgrade php53-pcntlUpgrade libmemcachedutil2Upgrade php72-intlUpgrade php5-tokenizerUpgrade php7-zlibUpgrade php53-xmlwriterUpgrade php5-intlUpgrade php7-shmopUpgrade php7-opcacheUpgrade php72-develUpgrade tidyUpgrade php7-fileinfoUpgrade php7-bcmathUpgrade php53-exifUpgrade php72-pspellUpgrade php53-gmpUpgrade php53-opensslUpgrade php72-jsonUpgrade php72-gmpUpgrade php72-dbaUpgrade php7-testresultsUpgrade php7-socketsUpgrade php72-mbstringUpgrade php53-jsonUpgrade php53Upgrade php72-memcachedUpgrade php5-gdUpgrade php7-mysqlUpgrade php72-pcntlUpgrade php72-wddxUpgrade php72-fastcgiUpgrade php5-dbaUpgrade php5-zlibUpgrade php7-pspellUpgrade php53-xslUpgrade php53-bz2Upgrade php5-curlUpgrade php72-ftpUpgrade php72-tidyUpgrade apache2-mod_php72Upgrade php7-fastcgiUpgrade php5-opcacheUpgrade php7-enchantUpgrade php53-tokenizerUpgrade php5-pspellUpgrade php5-fpmUpgrade php72-calendarUpgrade php5-enchantUpgrade php72-enchantUpgrade php7-sysvsemUpgrade php7-pear-archive_tarUpgrade php7-ctypeUpgrade php7-pearUpgrade php5-odbcUpgrade libmemcached11Upgrade php7-tokenizer | Apr 6, 2019 | Feb 22, 2019 |
| Ubuntu | — | Upgrade php5-xmlrpcUpgrade php7.0-xmlrpcUpgrade php7.0-fpmUpgrade libapache2-mod-php5Upgrade php7.0-mbstringUpgrade php7.0-cliUpgrade libapache2-mod-php7.0Upgrade php5-cgiUpgrade php5-fpmUpgrade php5-cliUpgrade php7.0-cgi | Mar 15, 2019 | Feb 22, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub