Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-opcacheUpgrade php-mbstringUpgrade php-soapUpgrade libzip-toolsUpgrade php-processUpgrade php-xmlrpcUpgrade php-enchantUpgrade php-ffiUpgrade php-pecl-rrdUpgrade apcu-panelUpgrade libzip-develUpgrade php-gdUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-fpmUpgrade php-pearUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-dbgUpgrade php-develUpgrade php-xmlUpgrade php-commonUpgrade php-embeddedUpgrade php-jsonUpgrade php-pecl-zipUpgrade php-odbcUpgrade php-ldapUpgrade php-snmpUpgrade phpUpgrade libzipUpgrade php-bcmathUpgrade php-cliUpgrade php-pdoUpgrade php-mysqlnd | Oct 20, 2022 | Jan 18, 2021 |
| Alpine Linux | — | Upgrade drupal7 | Aug 22, 2024 | Jan 18, 2021 |
| Amazon Linux Ami 2 | — | Upgrade php-pear | Feb 22, 2021 | Jan 18, 2021 |
| Amazon_linux | — | Upgrade php7-pear | Feb 18, 2021 | Jan 18, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 18, 2021 |
| Centos_linux | — | Upgrade php-pearUpgrade php-pecl-apcu-develUpgrade php-embedded-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-zipUpgrade php-ffi-debuginfoUpgrade php-pdoUpgrade php-cliUpgrade php-mbstring-debuginfoUpgrade php-odbc-debuginfoUpgrade phpUpgrade php-common-debuginfoUpgrade php-fpmUpgrade php-pecl-zip-debuginfoUpgrade php-fpm-debuginfoUpgrade php-json-debuginfoUpgrade php-commonUpgrade libzip-tools-debuginfoUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade libzip-debuginfoUpgrade php-embeddedUpgrade php-pgsqlUpgrade php-debugsourceUpgrade php-develUpgrade php-pecl-zip-debugsourceUpgrade libzipUpgrade php-dbgUpgrade php-odbcUpgrade php-gmpUpgrade php-pecl-apcuUpgrade php-xmlUpgrade php-pecl-xdebug-debugsourceUpgrade apcu-panelUpgrade php-pecl-xdebugUpgrade php-gd-debuginfoUpgrade php-jsonUpgrade php-dba-debuginfoUpgrade php-ldapUpgrade php-pecl-xdebug-debuginfoUpgrade php-enchantUpgrade php-enchant-debuginfoUpgrade php-gmp-debuginfoUpgrade php-soap-debuginfoUpgrade php-intlUpgrade php-xmlrpcUpgrade php-gdUpgrade php-bcmath-debuginfoUpgrade libzip-debugsourceUpgrade php-process-debuginfoUpgrade php-pdo-debuginfoUpgrade php-soapUpgrade php-pecl-rrdUpgrade php-pecl-rrd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-processUpgrade php-mysqlnd-debuginfoUpgrade php-opcacheUpgrade php-debuginfoUpgrade php-cli-debuginfoUpgrade php-ldap-debuginfoUpgrade php-ffiUpgrade libzip-toolsUpgrade php-pecl-rrd-debugsourceUpgrade php-intl-debuginfoUpgrade php-pgsql-debuginfoUpgrade libzip-develUpgrade php-pecl-apcu-debuginfoUpgrade php-mysqlndUpgrade php-dbaUpgrade php-snmp-debuginfoUpgrade php-snmpUpgrade php-dbg-debuginfoUpgrade php-xml-debuginfoUpgrade php-mbstring | Oct 20, 2022 | Jan 18, 2021 |
| Debian | — | Upgrade php-pear | Jan 25, 2021 | Jan 18, 2021 |
| Drupal | — | Upgrade to drupal version 7.78Upgrade to drupal version 8.9.1Upgrade to drupal version 9.0.1Upgrade to drupal version 9.1.3 | Jan 25, 2021 | Jan 18, 2021 |
| Gentoo Linux | — | Upgrade dev-php/PEAR-Archive_Tar. | Jan 26, 2021 | Jan 18, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-pear | May 18, 2021 | Jan 18, 2021 |
| Oracle_linux | — | Upgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-develUpgrade php-pgsqlUpgrade php-pecl-xdebugUpgrade php-gdUpgrade php-pdoUpgrade libzipUpgrade php-pecl-apcuUpgrade php-odbcUpgrade php-pearUpgrade php-commonUpgrade php-fpmUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-mbstringUpgrade php-xmlrpcUpgrade php-enchantUpgrade php-soapUpgrade php-bcmathUpgrade libzip-toolsUpgrade php-xmlUpgrade php-processUpgrade php-ffiUpgrade php-intlUpgrade libzip-develUpgrade apcu-panelUpgrade phpUpgrade php-dbaUpgrade php-embeddedUpgrade php-snmpUpgrade php-opcacheUpgrade php-ldapUpgrade php-pecl-rrdUpgrade php-mysqlndUpgrade php-cliUpgrade php-dbg | Sep 17, 2022 | Jan 27, 2021 |
| Redhat_linux | — | Upgrade php-snmpUpgrade php-debuginfoUpgrade php-xmlrpcUpgrade php-mysqlndUpgrade php-pdoUpgrade php-snmp-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-mbstringUpgrade php-pecl-rrd-debuginfoUpgrade php-processUpgrade php-gdUpgrade php-pecl-rrdUpgrade php-intl-debuginfoUpgrade php-jsonUpgrade php-pecl-xdebugUpgrade php-ldap-debuginfoUpgrade php-xmlUpgrade php-pecl-zip-debugsourceUpgrade php-develUpgrade php-pearUpgrade php-xmlrpc-debuginfoUpgrade php-fpmUpgrade php-enchantUpgrade php-dbg-debuginfoUpgrade php-opcache-debuginfoUpgrade php-cliUpgrade php-gmpUpgrade php-pecl-xdebug-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-bcmathUpgrade libzip-toolsUpgrade php-pecl-apcu-develUpgrade php-pecl-rrd-debugsourceUpgrade php-debugsourceUpgrade php-intlUpgrade libzip-debugsourceUpgrade php-pecl-xdebug-debugsourceUpgrade php-embeddedUpgrade php-bcmath-debuginfoUpgrade php-opcacheUpgrade php-embedded-debuginfoUpgrade php-ffi-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zipNo solution existsUpgrade php-odbc-debuginfoUpgrade php-soap-debuginfoUpgrade php-dba-debuginfoUpgrade php-json-debuginfoUpgrade php-xml-debuginfoUpgrade libzipUpgrade php-gd-debuginfoUpgrade php-commonUpgrade php-process-debuginfoUpgrade php-dbaUpgrade php-common-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-odbcUpgrade php-ffiUpgrade libzip-tools-debuginfoUpgrade php-fpm-debuginfoUpgrade apcu-panelUpgrade php-gmp-debuginfoUpgrade php-pdo-debuginfoUpgrade php-soapUpgrade php-ldapUpgrade php-pgsqlUpgrade php-pecl-apcuUpgrade phpUpgrade php-dbgUpgrade php-mbstring-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-cli-debuginfoUpgrade libzip-develUpgrade php-enchant-debuginfo | Oct 20, 2022 | Jan 18, 2021 |
| Rocky_linux | — | Upgrade php-pecl-xdebug-debuginfoUpgrade php-mbstringUpgrade php-embeddedUpgrade php-gdUpgrade php-pecl-zip-debuginfoUpgrade php-dbg-debuginfoUpgrade php-debugsourceUpgrade php-develUpgrade php-odbcUpgrade php-pecl-apcu-develUpgrade php-xmlrpc-debuginfoUpgrade php-bcmathUpgrade php-pecl-rrd-debuginfoUpgrade libzipUpgrade php-dba-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-xml-debuginfoUpgrade php-enchant-debuginfoUpgrade php-ffi-debuginfoUpgrade php-gd-debuginfoUpgrade php-enchantUpgrade php-pdo-debuginfoUpgrade php-ldapUpgrade php-xmlrpcUpgrade php-dbgUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php-pecl-zipUpgrade php-odbc-debuginfoUpgrade php-pdoUpgrade php-gmpUpgrade php-soapUpgrade php-pecl-apcuUpgrade php-pgsqlUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-jsonUpgrade php-mbstring-debuginfoUpgrade php-debuginfoUpgrade php-gmp-debuginfoUpgrade php-snmpUpgrade php-pecl-apcu-debugsourceUpgrade php-embedded-debuginfoUpgrade php-opcache-debuginfoUpgrade php-json-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-rrdUpgrade php-snmp-debuginfoUpgrade php-cli-debuginfoUpgrade php-xmlUpgrade php-pecl-apcu-debuginfoUpgrade php-intlUpgrade php-dbaUpgrade php-soap-debuginfoUpgrade php-processUpgrade php-intl-debuginfoUpgrade libzip-debugsourceUpgrade php-ffiUpgrade phpUpgrade php-opcacheUpgrade php-bcmath-debuginfoUpgrade php-mysqlndUpgrade php-fpm-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-ldap-debuginfoUpgrade php-common-debuginfoUpgrade php-commonUpgrade libzip-toolsUpgrade libzip-develUpgrade php-cliUpgrade php-pecl-xdebug-debugsourceUpgrade php-process-debuginfo | Mar 12, 2024 | Jan 18, 2021 |
| Suse | — | Upgrade php7-pearUpgrade apache2-mod_php72Upgrade php72-jsonUpgrade php72-wddxUpgrade php72-sysvmsgUpgrade php72-opcacheUpgrade php72-tokenizerUpgrade php72-exifUpgrade php72-xslUpgrade php72-pcntlUpgrade php72-pearUpgrade php72-domUpgrade php72-intlUpgrade php72-develUpgrade php72-pharUpgrade php72-mbstringUpgrade php72-gdUpgrade php72-shmopUpgrade php72-enchantUpgrade php72-dbaUpgrade php72-sysvshmUpgrade php72-posixUpgrade php72-calendarUpgrade php72-opensslUpgrade php72-tidyUpgrade php72-fileinfoUpgrade php72-sodiumUpgrade php72-xmlwriterUpgrade php72-pear-archive_tarUpgrade php72-readlineUpgrade php72-pdoUpgrade php72-ftpUpgrade php72-zlibUpgrade php72-imapUpgrade php72-gmpUpgrade php72-ldapUpgrade php72-sqliteUpgrade php72-curlUpgrade php7-wddxUpgrade php72-zipUpgrade php74-pearUpgrade php72-bz2Upgrade php72-bcmathUpgrade php72-xmlreaderUpgrade php72-odbcUpgrade php7-peclUpgrade php72-sysvsemUpgrade php72-soapUpgrade php72-iconvUpgrade php72-gettextUpgrade php72Upgrade php72-pspellUpgrade php72-snmpUpgrade php72-fpmUpgrade php72-fastcgiUpgrade php72-pgsqlUpgrade php72-ctypeUpgrade php72-socketsUpgrade php72-mysqlUpgrade php74-peclUpgrade php72-xmlrpc | Aug 31, 2021 | Jan 18, 2021 |
| Ubuntu | — | Upgrade php-pear | Feb 9, 2021 | Jan 18, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub