Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-mbstringUpgrade php-processUpgrade php-pearUpgrade php-pecl-rrdUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade php-xmlUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php-develUpgrade libzip-toolsUpgrade php-dbaUpgrade php-commonUpgrade php-xmlrpcUpgrade php-pecl-zipUpgrade php-dbgUpgrade php-soapUpgrade php-embeddedUpgrade php-gmpUpgrade php-pecl-apcuUpgrade apcu-panelUpgrade php-ldapUpgrade php-snmpUpgrade libzip-develUpgrade phpUpgrade php-intlUpgrade php-opcacheUpgrade php-jsonUpgrade php-ffiUpgrade php-enchantUpgrade php-cliUpgrade libzipUpgrade php-pdoUpgrade php-bcmathUpgrade php-odbcUpgrade php-gdUpgrade php-mysqlnd | Oct 20, 2022 | Nov 19, 2020 |
| Alpine Linux | — | Upgrade drupal7 | Aug 22, 2024 | Nov 19, 2020 |
| Amazon Linux Ami 2 | — | Upgrade php-pear | Jan 8, 2021 | Nov 19, 2020 |
| Amazon_linux | — | Upgrade php7-pear | Jan 15, 2021 | Nov 19, 2020 |
| Centos_linux | — | Upgrade php-pecl-apcu-debugsourceUpgrade php-enchant-debuginfoUpgrade php-odbc-debuginfoUpgrade php-opcache-debuginfoUpgrade php-gmpUpgrade php-intlUpgrade php-dbgUpgrade php-pecl-zip-debugsourceUpgrade php-jsonUpgrade php-ldapUpgrade php-fpm-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-mbstring-debuginfoUpgrade libzip-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-soapUpgrade php-debuginfoUpgrade php-commonUpgrade php-common-debuginfoUpgrade php-pdo-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-dba-debuginfoUpgrade php-xml-debuginfoUpgrade php-odbcUpgrade php-pdoUpgrade php-pecl-apcuUpgrade php-pgsqlUpgrade php-cli-debuginfoUpgrade php-process-debuginfoUpgrade libzip-debugsourceUpgrade php-json-debuginfoUpgrade php-opcacheUpgrade libzipUpgrade php-develUpgrade libzip-toolsUpgrade php-pecl-xdebugUpgrade php-gd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-xmlUpgrade apcu-panelUpgrade php-cliUpgrade php-processUpgrade php-pearUpgrade php-bcmath-debuginfoUpgrade php-xmlrpcUpgrade php-snmp-debuginfoUpgrade php-snmpUpgrade libzip-tools-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-enchantUpgrade php-soap-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-mysqlndUpgrade php-mbstringUpgrade php-intl-debuginfoUpgrade php-bcmathUpgrade php-ffiUpgrade php-embedded-debuginfoUpgrade php-pecl-zipUpgrade php-dbg-debuginfoUpgrade php-gmp-debuginfoUpgrade phpUpgrade php-pecl-rrdUpgrade php-ldap-debuginfoUpgrade php-embeddedUpgrade php-pgsql-debuginfoUpgrade php-gdUpgrade libzip-develUpgrade php-fpmUpgrade php-debugsource | Oct 20, 2022 | Nov 19, 2020 |
| Debian | — | Upgrade php-pear | Nov 24, 2020 | Nov 19, 2020 |
| Drupal | — | Upgrade to drupal version 9.0.9Upgrade to drupal version 8.9.1Upgrade to drupal version 8.8.1Upgrade to drupal version 7.75 | Nov 27, 2020 | Nov 19, 2020 |
| Gentoo Linux | — | Upgrade dev-php/PEAR-Archive_Tar. | Jan 26, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-pear | Feb 22, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-pear | Jan 20, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-pear | Feb 2, 2021 | Nov 19, 2020 |
| Oracle Solaris | — | Upgrade web/php-80 to version 8.0.2-11.4.33.0.1.94.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.27-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/php-74 to version 7.4.15-11.4.32.0.1.88.2 on Solaris 11.4 | Apr 21, 2021 | Nov 19, 2020 |
| Oracle_linux | — | Upgrade libzip-develUpgrade php-commonUpgrade php-pgsqlUpgrade php-snmpUpgrade phpUpgrade apcu-panelUpgrade php-develUpgrade php-bcmathUpgrade php-intlUpgrade php-ldapUpgrade php-fpmUpgrade php-odbcUpgrade php-xmlUpgrade php-dbgUpgrade php-ffiUpgrade php-pecl-apcuUpgrade php-mysqlndUpgrade php-mbstringUpgrade php-pdoUpgrade php-gdUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-opcacheUpgrade php-enchantUpgrade libzip-toolsUpgrade php-processUpgrade php-xmlrpcUpgrade php-soapUpgrade php-dbaUpgrade libzipUpgrade php-embeddedUpgrade php-pecl-rrdUpgrade php-cliUpgrade php-pecl-zipUpgrade php-pecl-xdebugUpgrade php-gmpUpgrade php-pear | Sep 17, 2022 | Nov 19, 2020 |
| Redhat_linux | — | Upgrade php-soapUpgrade php-intlUpgrade php-embeddedUpgrade php-process-debuginfoUpgrade libzip-debugsourceUpgrade php-pgsqlUpgrade php-ffi-debuginfoUpgrade php-gd-debuginfoUpgrade php-gmp-debuginfoUpgrade php-gmpUpgrade php-pecl-xdebug-debuginfoUpgrade php-snmp-debuginfoUpgrade php-jsonUpgrade php-pecl-zipUpgrade php-pecl-apcu-debuginfoUpgrade phpUpgrade php-enchantUpgrade php-intl-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-rrdUpgrade php-gdUpgrade php-bcmathUpgrade php-develUpgrade php-dbaUpgrade php-processUpgrade php-debugsourceUpgrade php-dbg-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-fpm-debuginfoUpgrade libzipUpgrade libzip-tools-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-odbc-debuginfoUpgrade php-ldap-debuginfoUpgrade php-debuginfoUpgrade php-odbcUpgrade php-xml-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-common-debuginfoUpgrade php-snmpUpgrade php-mbstring-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade libzip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-dbgUpgrade php-mysqlndUpgrade php-ffiUpgrade php-pecl-zip-debuginfoUpgrade php-opcacheUpgrade php-mbstringUpgrade php-commonUpgrade php-mysqlnd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-apcuUpgrade php-dba-debuginfoUpgrade php-soap-debuginfoNo solution existsUpgrade php-pgsql-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade apcu-panelUpgrade php-ldapUpgrade php-pecl-xdebugUpgrade php-cliUpgrade libzip-develUpgrade php-enchant-debuginfoUpgrade php-xmlUpgrade libzip-toolsUpgrade php-pearUpgrade php-fpm | Oct 20, 2022 | Nov 19, 2020 |
| Rocky_linux | — | Upgrade php-gdUpgrade php-jsonUpgrade php-odbcUpgrade php-pecl-rrdUpgrade php-pecl-zip-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-common-debuginfoUpgrade php-pecl-xdebugUpgrade php-dba-debuginfoUpgrade php-bcmathUpgrade php-soapUpgrade php-json-debuginfoUpgrade php-processUpgrade php-odbc-debuginfoUpgrade php-xml-debuginfoUpgrade libzip-debuginfoUpgrade php-mbstringUpgrade php-pdoUpgrade php-commonUpgrade php-pecl-apcuUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbaUpgrade php-pdo-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-zipUpgrade php-cli-debuginfoUpgrade php-fpmUpgrade php-intl-debuginfoUpgrade php-pecl-apcu-develUpgrade php-enchant-debuginfoUpgrade php-pgsqlUpgrade php-gmpUpgrade libzip-debugsourceUpgrade php-develUpgrade php-xmlrpcUpgrade php-opcacheUpgrade libzip-develUpgrade php-pecl-zip-debuginfoUpgrade php-embedded-debuginfoUpgrade php-dbgUpgrade php-cliUpgrade php-xmlUpgrade php-pgsql-debuginfoUpgrade php-process-debuginfoUpgrade php-debugsourceUpgrade php-ldapUpgrade php-soap-debuginfoUpgrade libzipUpgrade php-snmpUpgrade php-pecl-rrd-debugsourceUpgrade php-enchantUpgrade php-ffi-debuginfoUpgrade php-fpm-debuginfoUpgrade php-intlUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade php-gd-debuginfoUpgrade php-ffiUpgrade php-pecl-apcu-debugsourceUpgrade phpUpgrade php-debuginfoUpgrade php-mysqlndUpgrade php-embeddedUpgrade libzip-toolsUpgrade php-snmp-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-gmp-debuginfo | Mar 12, 2024 | Nov 19, 2020 |
| Ubuntu | — | Upgrade drupal7 (Ubuntu Pro)Upgrade php-pear | Dec 2, 2020 | Nov 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub