In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-jsonUpgrade php-develUpgrade php-commonUpgrade php-dbaUpgrade php-pdoUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-pgsqlUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade php-mbstringUpgrade php-intlUpgrade php-gmpUpgrade php-soapUpgrade php-pecl-zipUpgrade php-dbgUpgrade php-pecl-rrdUpgrade php-gdUpgrade libzip-develUpgrade libzipUpgrade php-cliUpgrade php-opcacheUpgrade php-processUpgrade php-mysqlndUpgrade php-bcmathUpgrade php-pecl-xdebugUpgrade php-ldapUpgrade php-snmpUpgrade php-pearUpgrade php-ffiUpgrade php-enchantUpgrade php-xmlUpgrade apcu-panelUpgrade php-embeddedUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade php | May 13, 2022 | Sep 9, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Sep 9, 2020 |
| Amazon_linux | — | Upgrade php72Upgrade php73 | Sep 1, 2020 | Jul 6, 2020 |
| Centos_linux | — | Upgrade php-soap-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-snmp-debuginfoUpgrade libzip-debugsourceUpgrade phpUpgrade php-soapUpgrade libzip-develUpgrade php-fpmUpgrade php-mysqlndUpgrade php-gdUpgrade php-dbg-debuginfoUpgrade php-embeddedUpgrade php-enchantUpgrade php-mbstringUpgrade php-gmp-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-snmpUpgrade php-xmlrpcUpgrade php-pecl-zipUpgrade php-pecl-rrd-debuginfoUpgrade php-debugsourceUpgrade php-gd-debuginfoUpgrade php-embedded-debuginfoUpgrade php-cliUpgrade php-develUpgrade php-bcmathUpgrade libzipUpgrade php-xmlUpgrade php-processUpgrade php-pecl-xdebugUpgrade php-intl-debuginfoUpgrade php-pecl-rrdUpgrade php-opcacheUpgrade php-pdoUpgrade php-dbaUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pearUpgrade php-odbc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-jsonUpgrade php-json-debuginfoUpgrade php-pecl-apcuUpgrade php-process-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-enchant-debuginfoUpgrade libzip-toolsUpgrade php-gmpUpgrade php-dba-debuginfoUpgrade php-intlUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php-ldapUpgrade php-dbgUpgrade php-cli-debuginfoUpgrade php-bcmath-debuginfoUpgrade apcu-panelUpgrade php-pecl-xdebug-debuginfoUpgrade libzip-debuginfoUpgrade php-common-debuginfoUpgrade php-ffiUpgrade php-pgsqlUpgrade php-mysqlnd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-fpm-debuginfoUpgrade php-commonUpgrade php-ffi-debuginfoUpgrade php-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-xml-debuginfo | Nov 10, 2021 | Sep 9, 2020 |
| Debian | — | Upgrade php7.4 | Aug 28, 2020 | Aug 28, 2020 |
| Freebsd | — | Upgrade php73Upgrade php74Upgrade php72 | Aug 28, 2020 | Aug 27, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Sep 14, 2020 | Sep 9, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-pdoUpgrade php-xmlrpcUpgrade php-gdUpgrade php-processUpgrade php-cliUpgrade php-xmlUpgrade php-recodeUpgrade phpUpgrade php-soapUpgrade php-ldapUpgrade php-fpmUpgrade php-odbcUpgrade php-common | Nov 3, 2020 | Sep 9, 2020 |
| Oracle_linux | — | Upgrade php-pecl-rrdUpgrade libzip-develUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-xmlUpgrade php-pearUpgrade apcu-panelUpgrade php-develUpgrade php-xmlrpcUpgrade php-gmpUpgrade php-snmpUpgrade php-cliUpgrade php-pdoUpgrade php-jsonUpgrade php-pecl-zipUpgrade php-dbaUpgrade php-enchantUpgrade php-opcacheUpgrade libzipUpgrade php-ffiUpgrade php-gdUpgrade php-soapUpgrade php-fpmUpgrade php-processUpgrade phpUpgrade php-pecl-xdebugUpgrade php-bcmathUpgrade php-ldapUpgrade php-dbgUpgrade php-mbstringUpgrade php-pecl-apcuUpgrade php-intlUpgrade php-odbcUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade libzip-toolsUpgrade php-common | Nov 17, 2021 | Aug 6, 2020 |
| Php | — | Upgrade to PHP version 7.4.9Upgrade to PHP version 7.2.23Upgrade to PHP version 7.3.21 | Oct 5, 2020 | Sep 9, 2020 |
| Redhat_linux | — | Upgrade php-pearUpgrade php-mbstring-debuginfoNo solution existsUpgrade php-common-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pdoUpgrade php-ldapUpgrade php-opcacheUpgrade php-develUpgrade php-xmlUpgrade php-ffi-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbgUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-commonUpgrade php-dba-debuginfoUpgrade php-pecl-xdebugUpgrade libzip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-bcmathUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-mysqlndUpgrade php-json-debuginfoUpgrade libzip-develUpgrade php-pecl-xdebug-debugsourceUpgrade php-cliUpgrade php-snmpUpgrade php-enchant-debuginfoUpgrade php-fpmUpgrade php-pecl-rrd-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-opcache-debuginfoUpgrade php-debugsourceUpgrade php-ldap-debuginfoUpgrade php-soap-debuginfoUpgrade php-odbc-debuginfoUpgrade php-embeddedUpgrade libzip-debugsourceUpgrade php-dbg-debuginfoUpgrade php-pecl-zipUpgrade php-dbaUpgrade php-xmlrpcUpgrade php-embedded-debuginfoUpgrade libzip-toolsUpgrade php-fpm-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade libzipUpgrade php-pecl-apcu-develUpgrade php-xml-debuginfoUpgrade php-debuginfoUpgrade php-ffiUpgrade php-pgsqlUpgrade php-pecl-apcu-debuginfoUpgrade php-gd-debuginfoUpgrade php-pgsql-debuginfoUpgrade apcu-panelUpgrade php-pecl-rrdUpgrade php-enchantUpgrade phpUpgrade php-pdo-debuginfoUpgrade php-gdUpgrade php-cli-debuginfoUpgrade php-gmpUpgrade php-jsonUpgrade php-mbstringUpgrade php-intlUpgrade php-process-debuginfoUpgrade php-intl-debuginfoUpgrade php-processUpgrade php-soapUpgrade php-snmp-debuginfoUpgrade libzip-tools-debuginfo | Nov 10, 2021 | Sep 9, 2020 |
| Rocky_linux | — | Upgrade php-gd-debuginfoUpgrade php-snmp-debuginfoUpgrade php-mysqlndUpgrade php-snmpUpgrade php-opcache-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-processUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-zip-debugsourceUpgrade php-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-enchantUpgrade php-debugsourceUpgrade php-embedded-debuginfoUpgrade php-embeddedUpgrade php-pecl-xdebugUpgrade libzip-tools-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-xmlrpcUpgrade libzipUpgrade php-mbstringUpgrade php-fpmUpgrade php-develUpgrade php-pecl-rrdUpgrade php-cliUpgrade libzip-develUpgrade php-ldap-debuginfoUpgrade php-opcacheUpgrade php-xmlUpgrade php-dbg-debuginfoUpgrade php-gdUpgrade php-fpm-debuginfoUpgrade php-commonUpgrade libzip-debugsourceUpgrade php-ffi-debuginfoUpgrade phpUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-apcuUpgrade php-process-debuginfoUpgrade php-odbcUpgrade php-dbgUpgrade php-cli-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-soapUpgrade php-mbstring-debuginfoUpgrade php-dba-debuginfoUpgrade php-ldapUpgrade php-jsonUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmpUpgrade php-pecl-zip-debuginfoUpgrade php-dbaUpgrade libzip-toolsUpgrade php-xml-debuginfoUpgrade php-soap-debuginfoUpgrade php-ffiUpgrade php-pgsql-debuginfoUpgrade php-enchant-debuginfoUpgrade php-common-debuginfoUpgrade php-odbc-debuginfoUpgrade php-intlUpgrade php-pecl-xdebug-debugsourceUpgrade libzip-debuginfoUpgrade php-pecl-apcu-develUpgrade php-bcmathUpgrade php-gmp-debuginfoUpgrade php-json-debuginfoUpgrade php-pgsqlUpgrade php-pdo-debuginfoUpgrade php-pdo | Mar 12, 2024 | Sep 9, 2020 |
| Suse | — | Upgrade php7-fastcgiUpgrade php74-socketsUpgrade php7-ctypeUpgrade php74-snmpUpgrade php72-ftpUpgrade php5-intlUpgrade php74-tidyUpgrade php72-enchantUpgrade php72-iconvUpgrade php72-tidyUpgrade php5-xslUpgrade php72-xmlreaderUpgrade php7-sqliteUpgrade php5-ldapUpgrade php72-opensslUpgrade php74-fpmUpgrade php74-pcntlUpgrade php72-fastcgiUpgrade php7-socketsUpgrade php5-xmlrpcUpgrade php74-mysqlUpgrade php7-mcryptUpgrade php7-mysqlUpgrade php7-ftpUpgrade php5-domUpgrade php7-zipUpgrade php74-sqliteUpgrade php5-sysvmsgUpgrade php74-mbstringUpgrade php7-fileinfoUpgrade php7-testUpgrade php72-pspellUpgrade php72-ldapUpgrade php72-ctypeUpgrade php5-pearUpgrade apache2-mod_php72Upgrade php7-bcmathUpgrade php74-sysvshmUpgrade php5-imapUpgrade php72-gettextUpgrade php7-calendarUpgrade php74-ldapUpgrade php74-pdoUpgrade apache2-mod_php5Upgrade php7-odbcUpgrade php72-readlineUpgrade php74-posixUpgrade php72-jsonUpgrade php72-socketsUpgrade php72-pear-archive_tarUpgrade php72-dbaUpgrade php5-fpmUpgrade php72-calendarUpgrade apache2-mod_php74Upgrade php5-curlUpgrade php74-intlUpgrade php5-tokenizerUpgrade php5-sqliteUpgrade php7-pgsqlUpgrade php5-zlibUpgrade php7-pspellUpgrade php5-ctypeUpgrade php7-sysvsemUpgrade php7-pharUpgrade php7-pear-archive_tarUpgrade apache2-mod_php7Upgrade php5-sysvshmUpgrade php72-intlUpgrade php74-gettextUpgrade php74-tokenizerUpgrade php7-snmpUpgrade php74-dbaUpgrade php7-sysvmsgUpgrade php74-curlUpgrade php7-pearUpgrade php7-readlineUpgrade php7-tokenizerUpgrade php5-exifUpgrade php74-sodiumUpgrade php72-develUpgrade php72-odbcUpgrade php7-ldapUpgrade php7-xmlwriterUpgrade php7-develUpgrade php72-sqliteUpgrade php5-posixUpgrade php5-fileinfoUpgrade php5-zipUpgrade php74-develUpgrade php72-soapUpgrade php74-iconvUpgrade php7-jsonUpgrade php5-iconvUpgrade php7-zlibUpgrade php5-dbaUpgrade php74-odbcUpgrade php7-wddxUpgrade php5-socketsUpgrade php72-pharUpgrade php74-fileinfoUpgrade php7-iconvUpgrade php7-shmopUpgrade php72-gmpUpgrade php74-fastcgiUpgrade php5-enchantUpgrade php5-pspellUpgrade php5-suhosinUpgrade php5-pgsqlUpgrade php5-wddxUpgrade php74-shmopUpgrade php7-enchantUpgrade php5-mbstringUpgrade php5-gdUpgrade php5-mysqlUpgrade php72Upgrade php74-readlineUpgrade php7-xmlreaderUpgrade php5-ftpUpgrade php7-domUpgrade php5-xmlreaderUpgrade php74-calendarUpgrade php74-soapUpgrade php72-sysvsemUpgrade php7-gdUpgrade php74-jsonUpgrade php5-bz2Upgrade php7-pcntlUpgrade php74-pharUpgrade php72-shmopUpgrade php74-domUpgrade php74-sysvsemUpgrade php5-gmpUpgrade php72-curlUpgrade php7-mbstringUpgrade php5-opensslUpgrade php7-firebirdUpgrade php7-opcacheUpgrade php5-fastcgiUpgrade php74-gdUpgrade php74-bcmathUpgrade php74-xmlrpcUpgrade php74-opensslUpgrade php72-zlibUpgrade php5-snmpUpgrade php72-pearUpgrade php74-zlibUpgrade php7Upgrade php7-posixUpgrade php7-gmpUpgrade php72-opcacheUpgrade php72-exifUpgrade php74-exifUpgrade php72-xslUpgrade php72-zipUpgrade php74-bz2Upgrade php72-gdUpgrade php72-fpmUpgrade php74-xmlreaderUpgrade php72-wddxUpgrade php72-sysvshmUpgrade php7-sodiumUpgrade php7-opensslUpgrade php5-sysvsemUpgrade php5-odbcUpgrade php72-fileinfoUpgrade php5-soapUpgrade php5-pcntlUpgrade php7-pdoUpgrade php7-dbaUpgrade php7-exifUpgrade php5-bcmathUpgrade php7-xmlrpcUpgrade php72-mbstringUpgrade php72-domUpgrade php7-sysvshmUpgrade php72-sysvmsgUpgrade php74-enchantUpgrade php72-pcntlUpgrade php7-bz2Upgrade php5-pdoUpgrade php72-posixUpgrade php5-jsonUpgrade php7-gettextUpgrade php72-tokenizerUpgrade php72-bz2Upgrade php72-pgsqlUpgrade php72-imapUpgrade php5-xmlwriterUpgrade php7-intlUpgrade php7-imapUpgrade php72-bcmathUpgrade php5-gettextUpgrade php74-xmlwriterUpgrade php7-xslUpgrade php7-tidyUpgrade php72-snmpUpgrade php5-opcacheUpgrade php74-ctypeUpgrade php74-gmpUpgrade php5-pharUpgrade php74-ftpUpgrade php5-mcryptUpgrade php74Upgrade php7-soapUpgrade php5Upgrade php72-sodiumUpgrade php72-pdoUpgrade php5-calendarUpgrade php74-sysvmsgUpgrade php74-pgsqlUpgrade php72-xmlwriterUpgrade php7-fpmUpgrade php5-shmopUpgrade php72-xmlrpcUpgrade php74-xslUpgrade php7-embedUpgrade php7-curlUpgrade php74-zipUpgrade php74-opcacheUpgrade php72-mysql | Sep 2, 2020 | Jul 6, 2020 |
| Ubuntu | — | Upgrade libapache2-mod-php7.4Upgrade php7.4-fpmUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cli (Ubuntu Pro)Upgrade php5-fpm (Ubuntu Pro)Upgrade php7.2-cliUpgrade php7.0-cli (Ubuntu Pro)Upgrade php7.2-fpmUpgrade php7.4-cliUpgrade php7.4-cgiUpgrade libapache2-mod-php7.2Upgrade libapache2-mod-php7.0 (Ubuntu Pro)Upgrade php7.2-cgiUpgrade php5-cgi (Ubuntu Pro)Upgrade php7.0-fpm (Ubuntu Pro)Upgrade php7.0-cgi (Ubuntu Pro) | Jul 8, 2021 | Jul 6, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub