Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-dbgUpgrade php-pdoUpgrade php-odbcUpgrade libzip-develUpgrade php-enchantUpgrade php-bcmathUpgrade php-mysqlndUpgrade php-jsonUpgrade php-gdUpgrade phpUpgrade php-intlUpgrade php-cliUpgrade libzipUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-embeddedUpgrade php-gmpUpgrade php-pecl-zipUpgrade php-snmpUpgrade php-soapUpgrade php-ffiUpgrade apcu-panelUpgrade php-opcacheUpgrade php-processUpgrade php-dbaUpgrade php-pearUpgrade php-pgsqlUpgrade php-pecl-rrdUpgrade php-pecl-apcu-develUpgrade libzip-toolsUpgrade php-develUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-xmlUpgrade php-mbstringUpgrade php-commonUpgrade php-fpm | Oct 20, 2022 | Nov 19, 2020 |
| Alpine Linux | — | Upgrade drupal7 | Aug 22, 2024 | Nov 19, 2020 |
| Amazon Linux Ami 2 | — | Upgrade php-pear | Jan 8, 2021 | Nov 19, 2020 |
| Amazon_linux | — | Upgrade php7-pear | Jan 15, 2021 | Nov 19, 2020 |
| Centos_linux | — | Upgrade apcu-panelUpgrade php-snmpUpgrade php-pecl-xdebugUpgrade php-cliUpgrade libzip-toolsUpgrade php-debugsourceUpgrade php-fpmUpgrade php-mbstringUpgrade php-intl-debuginfoUpgrade php-xmlrpcUpgrade php-bcmathUpgrade phpUpgrade php-ffiUpgrade php-snmp-debuginfoUpgrade libzip-develUpgrade php-gd-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-develUpgrade php-mysqlndUpgrade php-xmlUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-embedded-debuginfoUpgrade php-enchantUpgrade php-pecl-rrd-debugsourceUpgrade php-soap-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pearUpgrade php-dbg-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-zipUpgrade php-gdUpgrade php-bcmath-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-rrdUpgrade php-embeddedUpgrade php-pecl-rrd-debuginfoUpgrade libzipUpgrade php-opcacheUpgrade php-processUpgrade php-intlUpgrade php-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-dbgUpgrade php-xml-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-enchant-debuginfoUpgrade php-process-debuginfoUpgrade php-opcache-debuginfoUpgrade libzip-debugsourceUpgrade php-pgsqlUpgrade php-pdo-debuginfoUpgrade php-soapUpgrade php-dbaUpgrade php-common-debuginfoUpgrade php-pecl-apcu-develUpgrade php-json-debuginfoUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-pdoUpgrade php-pecl-zip-debuginfoUpgrade php-ldapUpgrade php-jsonUpgrade php-fpm-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmpUpgrade php-ffi-debuginfoUpgrade php-cli-debuginfoUpgrade php-commonUpgrade libzip-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-zip-debugsource | Oct 20, 2022 | Nov 19, 2020 |
| Debian | — | Upgrade php-pear | Nov 24, 2020 | Nov 19, 2020 |
| Drupal | — | Upgrade to drupal version 8.9.1Upgrade to drupal version 9.0.9Upgrade to drupal version 7.75Upgrade to drupal version 8.8.1 | Nov 27, 2020 | Nov 19, 2020 |
| Gentoo Linux | — | Upgrade dev-php/PEAR-Archive_Tar. | Jan 26, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-pear | Feb 22, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-pear | Jan 20, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-pear | Feb 2, 2021 | Nov 19, 2020 |
| Oracle Solaris | — | Upgrade web/php-74 to version 7.4.15-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/php-73 to version 7.3.27-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/php-80 to version 8.0.2-11.4.33.0.1.94.0 on Solaris 11.4 | Apr 21, 2021 | Nov 19, 2020 |
| Oracle_linux | — | Upgrade phpUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-fpmUpgrade php-dbgUpgrade php-odbcUpgrade php-pgsqlUpgrade libzip-develUpgrade apcu-panelUpgrade php-xmlUpgrade php-bcmathUpgrade php-commonUpgrade php-ffiUpgrade php-develUpgrade php-ldapUpgrade php-snmpUpgrade php-pecl-zipUpgrade php-gdUpgrade libzip-toolsUpgrade php-pecl-rrdUpgrade libzipUpgrade php-pearUpgrade php-processUpgrade php-dbaUpgrade php-enchantUpgrade php-pdoUpgrade php-cliUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-soapUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-mbstringUpgrade php-gmpUpgrade php-pecl-apcu-develUpgrade php-json | Sep 17, 2022 | Nov 19, 2020 |
| Redhat_linux | — | Upgrade php-pecl-zip-debugsourceUpgrade php-gmp-debuginfoUpgrade php-enchantUpgrade php-gmpUpgrade php-embeddedUpgrade php-process-debuginfoUpgrade php-pecl-rrdUpgrade php-debugsourceUpgrade php-develUpgrade php-soapUpgrade php-intlUpgrade php-intl-debuginfoUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade libzip-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-bcmathUpgrade php-gdUpgrade php-embedded-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-cli-debuginfoUpgrade php-dbg-debuginfoUpgrade php-odbc-debuginfoUpgrade php-jsonUpgrade php-dbaUpgrade php-ffi-debuginfoUpgrade php-pecl-apcu-develUpgrade php-snmp-debuginfoUpgrade php-pdo-debuginfoUpgrade php-ldap-debuginfoUpgrade php-gd-debuginfoUpgrade libzip-tools-debuginfoUpgrade phpUpgrade php-processUpgrade php-pdoUpgrade libzipUpgrade php-pecl-zipUpgrade php-xmlrpc-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-json-debuginfoUpgrade php-mbstringUpgrade php-opcache-debuginfoUpgrade php-commonUpgrade php-ffiUpgrade apcu-panelUpgrade php-dbgUpgrade php-pearUpgrade php-mbstring-debuginfoUpgrade php-xml-debuginfoUpgrade php-cliUpgrade libzip-develUpgrade libzip-toolsUpgrade php-opcacheUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-apcuUpgrade php-pgsql-debuginfoUpgrade php-dba-debuginfoUpgrade libzip-debuginfoUpgrade php-enchant-debuginfoUpgrade php-ldapUpgrade php-xmlNo solution existsUpgrade php-bcmath-debuginfoUpgrade php-soap-debuginfoUpgrade php-debuginfoUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-debugsourceUpgrade php-fpmUpgrade php-mysqlndUpgrade php-pecl-xdebug-debugsourceUpgrade php-snmpUpgrade php-common-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-odbcUpgrade php-mysqlnd-debuginfo | Oct 20, 2022 | Nov 19, 2020 |
| Rocky_linux | — | Upgrade phpUpgrade php-intlUpgrade php-embedded-debuginfoUpgrade php-fpm-debuginfoUpgrade php-cliUpgrade php-dbgUpgrade php-pecl-zip-debuginfoUpgrade php-process-debuginfoUpgrade libzip-develUpgrade php-snmp-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-soap-debuginfoUpgrade php-xmlUpgrade php-ffiUpgrade php-gd-debuginfoUpgrade php-embeddedUpgrade php-pecl-apcu-debuginfoUpgrade php-debuginfoUpgrade libzip-toolsUpgrade php-bcmath-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-debugsourceUpgrade php-gmp-debuginfoUpgrade php-ldapUpgrade php-opcacheUpgrade php-enchantUpgrade php-pecl-rrd-debugsourceUpgrade libzipUpgrade php-ldap-debuginfoUpgrade php-snmpUpgrade php-ffi-debuginfoUpgrade php-mysqlndUpgrade php-mbstringUpgrade libzip-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-bcmathUpgrade libzip-debugsourceUpgrade php-jsonUpgrade php-gmpUpgrade php-fpmUpgrade php-dbaUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-json-debuginfoUpgrade php-common-debuginfoUpgrade php-opcache-debuginfoUpgrade php-gdUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-dba-debuginfoUpgrade php-soapUpgrade php-pdoUpgrade php-odbc-debuginfoUpgrade php-pecl-xdebugUpgrade php-pdo-debuginfoUpgrade php-pgsqlUpgrade php-intl-debuginfoUpgrade php-pecl-apcu-develUpgrade php-enchant-debuginfoUpgrade php-develUpgrade php-xmlrpcUpgrade php-pecl-apcuUpgrade php-pecl-rrdUpgrade libzip-tools-debuginfoUpgrade php-processUpgrade php-cli-debuginfoUpgrade php-pecl-zipUpgrade php-odbcUpgrade php-pecl-zip-debugsourceUpgrade php-commonUpgrade php-xml-debuginfoUpgrade php-mysqlnd-debuginfo | Mar 12, 2024 | Nov 19, 2020 |
| Ubuntu | — | Upgrade drupal7 (Ubuntu Pro)Upgrade php-pear | Dec 2, 2020 | Nov 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub