Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-odbcUpgrade php-opcacheUpgrade php-soapUpgrade php-pecl-apcuUpgrade php-cliUpgrade apcu-panelUpgrade php-intlUpgrade libzip-develUpgrade libzipUpgrade php-mysqlndUpgrade php-bcmathUpgrade phpUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-snmpUpgrade php-enchantUpgrade php-ldapUpgrade php-pdoUpgrade php-embeddedUpgrade php-gdUpgrade php-ffiUpgrade php-gmpUpgrade php-dbgUpgrade php-processUpgrade php-fpmUpgrade php-pgsqlUpgrade php-mbstringUpgrade php-xmlUpgrade php-commonUpgrade php-pecl-rrdUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade libzip-toolsUpgrade php-develUpgrade php-pecl-apcu-develUpgrade php-pearUpgrade php-dba | Oct 20, 2022 | Nov 19, 2020 |
| Alpine Linux | — | Upgrade drupal7 | Aug 22, 2024 | Nov 19, 2020 |
| Amazon Linux Ami 2 | — | Upgrade php-pear | Jan 8, 2021 | Nov 19, 2020 |
| Amazon_linux | — | Upgrade php7-pear | Jan 15, 2021 | Nov 19, 2020 |
| Centos_linux | — | Upgrade php-pecl-apcuUpgrade php-ffi-debuginfoUpgrade php-dbgUpgrade php-common-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-enchant-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-fpm-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade libzip-debuginfoUpgrade php-debuginfoUpgrade php-pdoUpgrade php-odbcUpgrade php-odbc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-cli-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-jsonUpgrade php-ldapUpgrade php-pecl-zip-debuginfoUpgrade php-json-debuginfoUpgrade php-pgsqlUpgrade php-gmpUpgrade php-pecl-xdebug-debuginfoUpgrade php-commonUpgrade php-pecl-apcu-debugsourceUpgrade php-intlUpgrade libzip-debugsourceUpgrade php-opcache-debuginfoUpgrade php-process-debuginfoUpgrade php-soapUpgrade php-dba-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-embedded-debuginfoUpgrade php-dbg-debuginfoUpgrade php-processUpgrade php-pecl-rrd-debugsourceUpgrade php-opcacheUpgrade libzip-tools-debuginfoUpgrade php-snmpUpgrade php-snmp-debuginfoUpgrade php-ffiUpgrade php-cliUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-develUpgrade php-debugsourceUpgrade libzip-toolsUpgrade libzip-develUpgrade phpUpgrade apcu-panelUpgrade php-xmlrpcUpgrade php-bcmathUpgrade php-gd-debuginfoUpgrade php-intl-debuginfoUpgrade php-fpmUpgrade php-mysqlndUpgrade php-ldap-debuginfoUpgrade php-gdUpgrade php-embeddedUpgrade php-pearUpgrade php-bcmath-debuginfoUpgrade php-pecl-zipUpgrade php-pgsql-debuginfoUpgrade php-pecl-rrdUpgrade php-soap-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-enchantUpgrade libzipUpgrade php-xmlrpc-debuginfoUpgrade php-xml | Oct 20, 2022 | Nov 19, 2020 |
| Debian | — | Upgrade php-pear | Nov 24, 2020 | Nov 19, 2020 |
| Drupal | — | Upgrade to drupal version 7.75Upgrade to drupal version 8.9.1Upgrade to drupal version 8.8.1Upgrade to drupal version 9.0.9 | Nov 27, 2020 | Nov 19, 2020 |
| Gentoo Linux | — | Upgrade dev-php/PEAR-Archive_Tar. | Jan 26, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-pear | Feb 22, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-pear | Jan 20, 2021 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-pear | Feb 2, 2021 | Nov 19, 2020 |
| Oracle Solaris | — | Upgrade web/php-74 to version 7.4.15-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/php-80 to version 8.0.2-11.4.33.0.1.94.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.27-11.4.32.0.1.88.2 on Solaris 11.4 | Apr 21, 2021 | Nov 19, 2020 |
| Oracle_linux | — | Upgrade libzip-develUpgrade php-bcmathUpgrade php-develUpgrade php-fpmUpgrade php-ffiUpgrade php-dbgUpgrade php-pecl-apcuUpgrade php-intlUpgrade apcu-panelUpgrade php-snmpUpgrade php-ldapUpgrade php-odbcUpgrade phpUpgrade php-xmlUpgrade php-pgsqlUpgrade php-commonUpgrade php-pecl-zipUpgrade libzipUpgrade php-pearUpgrade php-pdoUpgrade php-soapUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-enchantUpgrade php-processUpgrade php-cliUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade php-jsonUpgrade php-pecl-rrdUpgrade php-mbstringUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-gmpUpgrade php-opcacheUpgrade php-pecl-xdebugUpgrade php-gd | Sep 17, 2022 | Nov 19, 2020 |
| Redhat_linux | — | Upgrade php-pecl-xdebug-debuginfoUpgrade php-gmpUpgrade php-ffi-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade libzip-debugsourceUpgrade php-embeddedUpgrade php-pecl-apcu-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-odbc-debuginfoUpgrade libzipUpgrade php-bcmathUpgrade php-processUpgrade libzip-tools-debuginfoUpgrade php-dbaUpgrade php-dbg-debuginfoUpgrade php-debugsourceUpgrade php-cli-debuginfoUpgrade php-soapUpgrade php-pgsqlUpgrade php-intlUpgrade php-enchantUpgrade php-gdUpgrade php-snmp-debuginfoUpgrade php-intl-debuginfoUpgrade php-embedded-debuginfoUpgrade php-develUpgrade php-xmlrpcUpgrade php-pecl-rrdUpgrade php-gd-debuginfoUpgrade php-gmp-debuginfoUpgrade php-fpm-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdo-debuginfoUpgrade php-jsonUpgrade php-pdoUpgrade php-pecl-zipUpgrade phpUpgrade php-ldap-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-enchant-debuginfoUpgrade php-mysqlndUpgrade php-debuginfoUpgrade libzip-toolsUpgrade libzip-debuginfoUpgrade php-snmpUpgrade php-opcacheUpgrade php-ldapUpgrade php-bcmath-debuginfoUpgrade php-soap-debuginfoUpgrade php-xml-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-odbcUpgrade php-pecl-rrd-debuginfoUpgrade apcu-panelUpgrade php-pecl-xdebugUpgrade php-pecl-zip-debuginfoNo solution existsUpgrade php-ffiUpgrade php-dbgUpgrade php-common-debuginfoUpgrade php-xmlUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-fpmUpgrade php-pearUpgrade php-cliUpgrade php-json-debuginfoUpgrade php-dba-debuginfoUpgrade php-mbstringUpgrade php-pecl-apcuUpgrade php-mysqlnd-debuginfoUpgrade php-commonUpgrade php-opcache-debuginfoUpgrade libzip-devel | Oct 20, 2022 | Nov 19, 2020 |
| Rocky_linux | — | Upgrade php-json-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-apcuUpgrade php-odbc-debuginfoUpgrade libzip-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-processUpgrade php-mbstringUpgrade php-fpmUpgrade php-gdUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-intl-debuginfoUpgrade php-xml-debuginfoUpgrade php-cli-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-soapUpgrade php-bcmathUpgrade php-dbaUpgrade php-jsonUpgrade php-xmlrpc-debuginfoUpgrade libzip-debugsourceUpgrade php-pdo-debuginfoUpgrade php-pdoUpgrade php-pecl-zipUpgrade php-pecl-xdebug-debugsourceUpgrade php-dbg-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-commonUpgrade php-common-debuginfoUpgrade php-odbcUpgrade libzip-tools-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-develUpgrade php-pgsqlUpgrade php-pecl-rrdUpgrade php-opcache-debuginfoUpgrade php-develUpgrade php-enchant-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-gd-debuginfoUpgrade php-intlUpgrade php-snmpUpgrade php-enchantUpgrade php-pecl-rrd-debugsourceUpgrade php-ffiUpgrade php-embeddedUpgrade php-pecl-apcu-debugsourceUpgrade php-mysqlndUpgrade php-ldap-debuginfoUpgrade php-soap-debuginfoUpgrade php-debuginfoUpgrade php-bcmath-debuginfoUpgrade libzip-toolsUpgrade libzipUpgrade php-opcacheUpgrade php-gmp-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-xmlUpgrade php-debugsourceUpgrade php-ldapUpgrade php-cliUpgrade php-dbgUpgrade php-pgsql-debuginfoUpgrade php-embedded-debuginfoUpgrade phpUpgrade php-ffi-debuginfoUpgrade php-process-debuginfoUpgrade php-snmp-debuginfoUpgrade libzip-develUpgrade php-fpm-debuginfo | Mar 12, 2024 | Nov 19, 2020 |
| Ubuntu | — | Upgrade php-pearUpgrade drupal7 (Ubuntu Pro) | Dec 2, 2020 | Nov 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub