An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-apcuUpgrade php-pgsqlUpgrade php-jsonUpgrade php-intlUpgrade php-gmpUpgrade php-soapUpgrade php-dbgUpgrade php-pdoUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-ldapUpgrade php-develUpgrade php-mbstringUpgrade php-odbcUpgrade php-commonUpgrade libzip-develUpgrade php-mysqlndUpgrade php-processUpgrade php-cliUpgrade php-pearUpgrade libzipUpgrade php-bcmathUpgrade libzip-toolsUpgrade php-snmpUpgrade php-enchantUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-opcacheUpgrade php-gdUpgrade apcu-panelUpgrade php-embeddedUpgrade phpUpgrade php-xmlUpgrade php-pecl-zip | May 4, 2022 | Feb 22, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Feb 22, 2019 |
| Centos_linux | — | Upgrade php-cli-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debugsourceUpgrade php-snmp-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pgsqlUpgrade php-opcache-debuginfoUpgrade php-process-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pearUpgrade php-mbstringUpgrade php-gmpUpgrade php-xml-debuginfoUpgrade php-odbcUpgrade php-common-debuginfoUpgrade php-debuginfoUpgrade php-dbgUpgrade php-dba-debuginfoUpgrade php-pdo-debuginfoUpgrade php-jsonUpgrade php-json-debuginfoUpgrade php-pecl-apcu-develUpgrade php-fpmUpgrade php-enchant-debuginfoUpgrade php-intl-debuginfoUpgrade libzip-debuginfoUpgrade php-develUpgrade php-commonUpgrade php-xmlrpcUpgrade php-snmpUpgrade phpUpgrade php-cliUpgrade php-pgsql-debuginfoUpgrade php-embedded-debuginfoUpgrade php-gmp-debuginfoUpgrade php-xmlUpgrade php-soap-debuginfoUpgrade php-recode-debuginfoUpgrade php-bcmathUpgrade php-soapUpgrade libzip-toolsUpgrade php-pecl-apcu-debuginfoUpgrade php-gdUpgrade php-pecl-zipUpgrade libzip-debugsourceUpgrade php-mysqlndUpgrade php-debugsourceUpgrade libzip-tools-debuginfoUpgrade apcu-panelUpgrade php-enchantUpgrade php-recodeUpgrade php-opcacheUpgrade php-pdoUpgrade php-ldapUpgrade php-gd-debuginfoUpgrade php-dbg-debuginfoUpgrade php-dbaUpgrade php-xmlrpc-debuginfoUpgrade libzip-develUpgrade php-processUpgrade libzipUpgrade php-embeddedUpgrade php-bcmath-debuginfoUpgrade php-intl | Apr 29, 2020 | Feb 22, 2019 |
| Debian | — | Upgrade php7.3 | Feb 25, 2019 | Feb 22, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-gdUpgrade php-processUpgrade php-pdoUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-cliUpgrade php-xmlUpgrade php-odbcUpgrade php-commonUpgrade php-ldapUpgrade php-pgsqlUpgrade phpUpgrade php-soap | Apr 2, 2019 | Feb 22, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-mysqlUpgrade php-odbcUpgrade php-soapUpgrade php-ldapUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-pdoUpgrade php-gdUpgrade php-cliUpgrade php-xmlUpgrade php-recodeUpgrade phpUpgrade php-processUpgrade php-common | Mar 27, 2019 | Feb 22, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade phpUpgrade php-xmlrpcUpgrade php-cliUpgrade php-processUpgrade php-recodeUpgrade php-soapUpgrade php-ldapUpgrade php-gdUpgrade php-pdoUpgrade php-mysqlUpgrade php-commonUpgrade php-pgsqlUpgrade php-xmlUpgrade php-odbc | Apr 3, 2019 | Feb 22, 2019 |
| Oracle Solaris | — | Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Feb 22, 2019 |
| Oracle_linux | — | Upgrade php-embeddedUpgrade php-xmlUpgrade libzip-develUpgrade phpUpgrade php-fpmUpgrade php-opcacheUpgrade php-pearUpgrade php-enchantUpgrade php-snmpUpgrade php-recodeUpgrade libzipUpgrade php-cliUpgrade php-gdUpgrade php-develUpgrade php-mysqlndUpgrade php-mbstringUpgrade php-processUpgrade php-xmlrpcUpgrade php-odbcUpgrade php-dbaUpgrade libzip-toolsUpgrade php-intlUpgrade php-pdoUpgrade php-jsonUpgrade apcu-panelUpgrade php-pgsqlUpgrade php-gmpUpgrade php-pecl-apcu-develUpgrade php-bcmathUpgrade php-soapUpgrade php-pecl-zipUpgrade php-ldapUpgrade php-pecl-apcuUpgrade php-commonUpgrade php-dbg | Jul 22, 2024 | Dec 6, 2018 |
| Php | — | Upgrade to PHP version 7.3.1Upgrade to PHP version 5.6.40Upgrade to PHP version 7.2.14 | Feb 27, 2019 | Feb 22, 2019 |
| Redhat_linux | — | Upgrade php-recode-debuginfoUpgrade php-commonUpgrade libzip-toolsUpgrade php-opcache-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-pgsql-debuginfoUpgrade apcu-panelUpgrade php-process-debuginfoUpgrade libzip-debuginfoUpgrade php-common-debuginfoUpgrade php-xmlUpgrade php-snmp-debuginfoUpgrade php-dbg-debuginfoUpgrade php-snmpUpgrade php-odbcUpgrade php-dba-debuginfoUpgrade phpUpgrade php-processUpgrade php-opcacheUpgrade php-fpm-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-cliUpgrade php-intlUpgrade php-mysqlndUpgrade php-intl-debuginfoUpgrade php-dbaUpgrade libzip-debugsourceUpgrade php-soap-debuginfoUpgrade php-mbstringUpgrade php-ldap-debuginfoUpgrade php-debuginfoUpgrade php-json-debuginfoUpgrade php-recodeUpgrade libzip-develUpgrade php-mysqlnd-debuginfoUpgrade php-gmp-debuginfoUpgrade php-gmpUpgrade php-embeddedUpgrade php-pecl-apcuUpgrade libzipUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-fpmUpgrade php-gdUpgrade php-ldapUpgrade php-odbc-debuginfoUpgrade php-bcmathUpgrade php-pgsqlUpgrade php-gd-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-debugsourceUpgrade php-cli-debuginfoUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-enchantUpgrade php-embedded-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-xml-debuginfoUpgrade php-soapUpgrade php-pecl-apcu-debuginfoNo solution existsUpgrade php-dbgUpgrade php-pdo-debuginfoUpgrade php-develUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-pecl-zipUpgrade php-pearUpgrade libzip-tools-debuginfo | Apr 29, 2020 | Feb 22, 2019 |
| Rocky_linux | — | Upgrade php-gdUpgrade php-gd-debuginfoUpgrade libzipUpgrade php-bcmath-debuginfoUpgrade php-intl-debuginfoUpgrade php-embeddedUpgrade php-fpmUpgrade php-recode-debuginfoUpgrade phpUpgrade php-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-gmp-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pecl-apcuUpgrade php-enchant-debuginfoUpgrade php-debugsourceUpgrade php-snmpUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade php-mysqlndUpgrade php-enchantUpgrade php-cliUpgrade libzip-develUpgrade php-xmlUpgrade php-opcacheUpgrade php-dbg-debuginfoUpgrade php-recodeUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-processUpgrade php-xml-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-dbgUpgrade php-process-debuginfoUpgrade php-pecl-zipUpgrade php-common-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-intlUpgrade php-dba-debuginfoUpgrade php-commonUpgrade php-cli-debuginfoUpgrade php-bcmathUpgrade libzip-debuginfoUpgrade php-fpm-debuginfoUpgrade php-odbc-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-dbaUpgrade php-pdo-debuginfoUpgrade php-develUpgrade php-mbstring-debuginfoUpgrade php-soapUpgrade php-snmp-debuginfoUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade libzip-tools-debuginfoUpgrade php-jsonUpgrade php-ldap-debuginfoUpgrade php-odbcUpgrade libzip-debugsourceUpgrade php-mbstringUpgrade php-json-debuginfoUpgrade php-gmpUpgrade php-pdoUpgrade php-ldap | Mar 12, 2024 | Feb 22, 2019 |
| Suse | — | Upgrade libmemcachedutil2Upgrade php5-suhosinUpgrade php72-gdUpgrade php5-exifUpgrade php53-dbaUpgrade php7-ctypeUpgrade php53-pcntlUpgrade php53-xmlwriterUpgrade php53-fastcgiUpgrade php53-xslUpgrade php7-sqliteUpgrade php53Upgrade php53-bz2Upgrade php72-memcachedUpgrade php5-gdUpgrade php5-posixUpgrade php5-sqliteUpgrade php72-mbstringUpgrade php72-pcntlUpgrade php72-fastcgiUpgrade php72-tidyUpgrade php7-opcacheUpgrade php7-snmpUpgrade php7-mysqlUpgrade php72-ftpUpgrade php53-opensslUpgrade php7-shmopUpgrade php7-testresultsUpgrade php72-socketsUpgrade php7-socketsUpgrade php53-gmpUpgrade php53-exifUpgrade php5-zlibUpgrade tidyUpgrade php72-pspellUpgrade php53-pearUpgrade php72-gmpUpgrade php72-pharUpgrade php5-iconvUpgrade apache2-mod_php53Upgrade php72-jsonUpgrade php7-readlineUpgrade php7-sysvshmUpgrade php72-dbaUpgrade php5-dbaUpgrade php53-intlUpgrade php53-mysqlUpgrade php7-dbaUpgrade php5-sysvshmUpgrade php7-ldapUpgrade php72-opensslUpgrade php7-wddxUpgrade php7-enchantUpgrade apache2-mod_php72Upgrade php7-fastcgiUpgrade php53-develUpgrade php72-calendarUpgrade php5-enchantUpgrade php7-pear-archive_tarUpgrade php5-pspellUpgrade php5-opcacheUpgrade php72-soapUpgrade php53-tokenizerUpgrade php7-xmlwriterUpgrade php72-opcacheUpgrade php7-fileinfoUpgrade php7-mcryptUpgrade php7-bcmathUpgrade php5-fileinfoUpgrade php5-domUpgrade php5-ldapUpgrade libtidy-0_99-0Upgrade php5-intlUpgrade php5-odbcUpgrade php5-ctypeUpgrade php5-shmopUpgrade php7-tokenizerUpgrade php5-mbstringUpgrade php7-pspellUpgrade php53-pspellUpgrade php7-develUpgrade php7-zlibUpgrade php5-tokenizerUpgrade php72-intlUpgrade libmemcached11Upgrade php53-domUpgrade php72-gettextUpgrade php72-enchantUpgrade php53-jsonUpgrade php7-pharUpgrade php7-calendarUpgrade php72-develUpgrade php53-xmlrpcUpgrade php7-pearUpgrade php7-zipUpgrade php5-curlUpgrade php5-pgsqlUpgrade php72-iconvUpgrade php72-ldapUpgrade php72-ctypeUpgrade php7-sysvsemUpgrade php72-wddxUpgrade php5-fpmUpgrade php7-odbcUpgrade php72-pear-archive_tarUpgrade php5-imapUpgrade php72-pgsqlUpgrade php53-zipUpgrade php72-xmlreaderUpgrade php72-snmpUpgrade php72-imapUpgrade php72-sqliteUpgrade php7-xmlrpcUpgrade php53-mcryptUpgrade php5-pearUpgrade php72-xmlrpcUpgrade php72-pdoUpgrade php53-readlineUpgrade php53-ftpUpgrade php7-curlUpgrade php5-sysvmsgUpgrade php5-wddxUpgrade php53-zlibUpgrade php5-xmlrpcUpgrade php53-ldapUpgrade php7-pcntlUpgrade php5-socketsUpgrade php5-gettextUpgrade php5-fastcgiUpgrade php53-sysvmsgUpgrade php53-sysvsemUpgrade php7-intlUpgrade php7-opensslUpgrade php7-posixUpgrade apache2-mod_php7Upgrade php53-xmlreaderUpgrade php53-gdUpgrade php72-bz2Upgrade php5-soapUpgrade php72-bcmathUpgrade php5-ftpUpgrade php72-sysvshmUpgrade php72-xslUpgrade php7-domUpgrade php72-posixUpgrade php5-mcryptUpgrade php5-snmpUpgrade php53-sqliteUpgrade php53-soapUpgrade php72-zlibUpgrade php5-jsonUpgrade php72-curlUpgrade php72-tokenizerUpgrade php72-shmopUpgrade php7-pdoUpgrade php5-bcmathUpgrade php53-wddxUpgrade php72-sysvmsgUpgrade php72-pearUpgrade php72-mysqlUpgrade php72-domUpgrade php72Upgrade php7-xmlreaderUpgrade php72-exifUpgrade php7-imapUpgrade php7-tidyUpgrade php7-gettextUpgrade php53-tidyUpgrade php7-firebirdUpgrade php53-socketsUpgrade php53-snmpUpgrade php5-xmlwriterUpgrade php5-sysvsemUpgrade php5-pcntlUpgrade php5-zipUpgrade php53-odbcUpgrade php7-fpmUpgrade php5-xslUpgrade php5-gmpUpgrade php53-fileinfoUpgrade php72-zipUpgrade php53-pdoUpgrade php5-pharUpgrade php5Upgrade php5-mysqlUpgrade php7-jsonUpgrade php7-ftpUpgrade php53-ctypeUpgrade php7-xslUpgrade php7-mbstringUpgrade php7-gmpUpgrade php53-suhosinUpgrade php53-imapUpgrade libtidy-0_99-0-develUpgrade libmemcachedUpgrade php7-embedUpgrade php7-exifUpgrade php7-bz2Upgrade php7Upgrade php53-shmopUpgrade php5-develUpgrade apache2-mod_php5Upgrade php72-odbcUpgrade php7-gdUpgrade php72-xmlwriterUpgrade php72-fileinfoUpgrade php5-opensslUpgrade php53-curlUpgrade php7-sysvmsgUpgrade php5-pdoUpgrade php53-calendarUpgrade php72-sysvsemUpgrade php5-calendarUpgrade php7-sodiumUpgrade php7-pgsqlUpgrade php5-xmlreaderUpgrade php7-soapUpgrade php53-pgsqlUpgrade php53-sysvshmUpgrade php53-gettextUpgrade libmemcached-develUpgrade php72-readlineUpgrade php53-mbstringUpgrade php53-posixUpgrade php72-fpmUpgrade php7-iconvUpgrade php53-bcmathUpgrade php53-iconvUpgrade php5-bz2 | Apr 6, 2019 | Feb 22, 2019 |
| Ubuntu | — | Upgrade libapache2-mod-php5Upgrade php7.0-fpmUpgrade php7.0-mbstringUpgrade php7.0-xmlrpcUpgrade php5-xmlrpcUpgrade libapache2-mod-php7.0Upgrade php7.0-cliUpgrade php5-cliUpgrade php5-cgiUpgrade php7.0-cgiUpgrade php5-fpm | Mar 15, 2019 | Feb 22, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub