In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libzip-develUpgrade php-ffiUpgrade php-bcmathUpgrade php-opcacheUpgrade php-pecl-rrdUpgrade php-embeddedUpgrade apcu-panelUpgrade php-processUpgrade php-enchantUpgrade php-gdUpgrade php-snmpUpgrade libzipUpgrade php-pearUpgrade phpUpgrade php-ldapUpgrade libzip-toolsUpgrade php-mysqlndUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-cliUpgrade php-gmpUpgrade php-dbgUpgrade php-jsonUpgrade php-pecl-apcuUpgrade php-soapUpgrade php-pgsqlUpgrade php-intlUpgrade php-develUpgrade php-dbaUpgrade php-pecl-zipUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-mbstringUpgrade php-odbcUpgrade php-common | May 13, 2022 | Sep 9, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Sep 9, 2020 |
| Amazon_linux | — | Upgrade php73Upgrade php72 | Sep 1, 2020 | Jul 6, 2020 |
| Centos_linux | — | Upgrade php-intl-debuginfoUpgrade php-opcacheUpgrade php-cliUpgrade php-develUpgrade php-xmlUpgrade php-gd-debuginfoUpgrade php-pecl-rrdUpgrade php-dbaUpgrade php-soap-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-snmpUpgrade php-mysqlndUpgrade php-embedded-debuginfoUpgrade php-xmlrpcUpgrade libzipUpgrade php-xmlrpc-debuginfoUpgrade libzip-develUpgrade php-pecl-rrd-debugsourceUpgrade php-pdoUpgrade php-pecl-zipUpgrade php-mbstringUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-snmp-debuginfoUpgrade php-debugsourceUpgrade php-ldap-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-gdUpgrade php-fpmUpgrade php-enchantUpgrade phpUpgrade php-dbg-debuginfoUpgrade libzip-debugsourceUpgrade php-soapUpgrade php-pecl-xdebugUpgrade php-processUpgrade php-bcmathUpgrade php-pearUpgrade php-embeddedUpgrade php-json-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pgsqlUpgrade php-common-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-intlUpgrade php-pecl-zip-debuginfoUpgrade php-process-debuginfoUpgrade php-pdo-debuginfoUpgrade php-ffi-debuginfoUpgrade php-commonUpgrade php-ffiUpgrade php-dba-debuginfoUpgrade libzip-toolsUpgrade php-jsonUpgrade php-gmpUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php-ldapUpgrade php-dbgUpgrade php-cli-debuginfoUpgrade php-bcmath-debuginfoUpgrade apcu-panelUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcu-develUpgrade php-opcache-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-fpm-debuginfoUpgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcuUpgrade php-debuginfo | Nov 10, 2021 | Sep 9, 2020 |
| Debian | — | Upgrade php7.4 | Aug 28, 2020 | Aug 28, 2020 |
| Freebsd | — | Upgrade php74Upgrade php73Upgrade php72 | Aug 28, 2020 | Aug 27, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Sep 14, 2020 | Sep 9, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-pdoUpgrade php-xmlrpcUpgrade php-processUpgrade php-gdUpgrade php-xmlUpgrade php-cliUpgrade php-recodeUpgrade php-soapUpgrade phpUpgrade php-ldapUpgrade php-commonUpgrade php-fpmUpgrade php-odbc | Nov 3, 2020 | Sep 9, 2020 |
| Oracle_linux | — | Upgrade php-mysqlndUpgrade php-pdoUpgrade php-embeddedUpgrade php-processUpgrade php-ffiUpgrade phpUpgrade libzip-develUpgrade php-bcmathUpgrade php-gdUpgrade php-soapUpgrade php-opcacheUpgrade apcu-panelUpgrade php-enchantUpgrade php-cliUpgrade php-fpmUpgrade php-pearUpgrade php-xmlUpgrade php-develUpgrade php-pecl-rrdUpgrade php-gmpUpgrade php-snmpUpgrade php-dbaUpgrade php-jsonUpgrade php-pecl-xdebugUpgrade php-xmlrpcUpgrade php-pecl-zipUpgrade libzipUpgrade php-ldapUpgrade php-commonUpgrade php-dbgUpgrade php-pecl-apcu-develUpgrade libzip-toolsUpgrade php-pgsqlUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-intlUpgrade php-mbstring | Nov 17, 2021 | Aug 6, 2020 |
| Php | — | Upgrade to PHP version 7.4.9Upgrade to PHP version 7.2.23Upgrade to PHP version 7.3.21 | Oct 5, 2020 | Sep 9, 2020 |
| Redhat_linux | — | Upgrade php-xmlrpcUpgrade php-opcache-debuginfoUpgrade php-intl-debuginfoUpgrade php-soap-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-rrdUpgrade php-soapUpgrade libzip-tools-debuginfoUpgrade php-embeddedUpgrade php-mbstringUpgrade php-gmpUpgrade php-gd-debuginfoUpgrade libzip-toolsUpgrade php-gdUpgrade php-cli-debuginfoUpgrade php-dbg-debuginfoUpgrade php-jsonUpgrade php-embedded-debuginfoUpgrade php-pecl-zipUpgrade libzip-debugsourceUpgrade php-pdo-debuginfoUpgrade php-fpm-debuginfoUpgrade phpUpgrade php-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-odbc-debuginfoUpgrade php-ffiUpgrade php-pecl-apcu-develUpgrade php-processUpgrade php-bcmath-debuginfoUpgrade php-intlUpgrade php-snmp-debuginfoUpgrade php-dbaUpgrade php-process-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-enchantUpgrade libzipUpgrade php-xml-debuginfoUpgrade php-debuginfoUpgrade php-pgsqlUpgrade apcu-panelUpgrade php-xmlUpgrade php-pearUpgrade php-snmpUpgrade php-json-debuginfoUpgrade php-odbcUpgrade php-bcmathUpgrade php-enchant-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-cliUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug-debugsourceUpgrade php-opcacheUpgrade php-pdoUpgrade php-ldapNo solution existsUpgrade php-develUpgrade libzip-debuginfoUpgrade php-dbgUpgrade php-ffi-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-zip-debuginfoUpgrade libzip-develUpgrade php-gmp-debuginfoUpgrade php-commonUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-xdebugUpgrade php-mysqlndUpgrade php-pecl-xdebug-debuginfoUpgrade php-common-debuginfoUpgrade php-fpmUpgrade php-pecl-zip-debugsource | Nov 10, 2021 | Sep 9, 2020 |
| Rocky_linux | — | Upgrade php-pecl-rrdUpgrade php-cliUpgrade libzip-develUpgrade php-xmlrpcUpgrade php-gd-debuginfoUpgrade php-intlUpgrade php-pecl-xdebug-debugsourceUpgrade php-odbc-debuginfoUpgrade libzip-debuginfoUpgrade php-gmpUpgrade php-pecl-xdebug-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade libzip-debugsourceUpgrade libzip-toolsUpgrade php-dbaUpgrade php-ffiUpgrade php-gmp-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-bcmathUpgrade php-pecl-apcu-develUpgrade php-common-debuginfoUpgrade php-commonUpgrade php-fpm-debuginfoUpgrade php-pdoUpgrade php-pdo-debuginfoUpgrade php-odbcUpgrade php-pecl-apcuUpgrade phpUpgrade php-json-debuginfoUpgrade php-ffi-debuginfoUpgrade php-ldapUpgrade php-soap-debuginfoUpgrade php-xml-debuginfoUpgrade php-dba-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-dbgUpgrade php-pecl-apcu-debugsourceUpgrade php-cli-debuginfoUpgrade php-jsonUpgrade php-pgsqlUpgrade php-process-debuginfoUpgrade php-soapUpgrade php-bcmath-debuginfoUpgrade php-fpmUpgrade php-debugsourceUpgrade php-opcacheUpgrade php-mysqlndUpgrade php-ldap-debuginfoUpgrade php-xmlUpgrade php-intl-debuginfoUpgrade php-processUpgrade php-opcache-debuginfoUpgrade php-develUpgrade php-pecl-rrd-debuginfoUpgrade php-enchantUpgrade php-embedded-debuginfoUpgrade php-pecl-xdebugUpgrade libzip-tools-debuginfoUpgrade php-snmpUpgrade php-debuginfoUpgrade php-embeddedUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-zipUpgrade php-mysqlnd-debuginfoUpgrade php-dbg-debuginfoUpgrade php-snmp-debuginfoUpgrade php-gdUpgrade php-mbstringUpgrade php-pecl-rrd-debugsourceUpgrade libzip | Mar 12, 2024 | Sep 9, 2020 |
| Suse | — | Upgrade php5Upgrade php5-snmpUpgrade php72-gdUpgrade php72-posixUpgrade php74-xmlrpcUpgrade php5-xmlreaderUpgrade php74-xmlwriterUpgrade php5-pdoUpgrade php72-zlibUpgrade php72-xslUpgrade php74-sysvsemUpgrade php7-xmlreaderUpgrade php74-domUpgrade php5-bz2Upgrade php74-xslUpgrade php74-calendarUpgrade php72-sodiumUpgrade php74-bz2Upgrade php72-shmopUpgrade php72-zipUpgrade php5-shmopUpgrade php72-sysvshmUpgrade php74-exifUpgrade php5-pcntlUpgrade php74-gmpUpgrade php7-domUpgrade php72-exifUpgrade php72-opcacheUpgrade php72-xmlwriterUpgrade php7-embedUpgrade php74-ctypeUpgrade php74-zipUpgrade php7-curlUpgrade php74-pgsqlUpgrade php72-domUpgrade php5-bcmathUpgrade php72-pdoUpgrade php74-jsonUpgrade php7-tidyUpgrade php74-sysvmsgUpgrade php7-sysvshmUpgrade php74-soapUpgrade php7-xmlrpcUpgrade php74-opcacheUpgrade php74-readlineUpgrade php74-pharUpgrade php72-pcntlUpgrade php7-bz2Upgrade php7-fpmUpgrade php7-exifUpgrade php7-gdUpgrade php7-pdoUpgrade php72-sysvsemUpgrade php72-mbstringUpgrade php5-opcacheUpgrade php7-opcacheUpgrade php74-gdUpgrade php5-gettextUpgrade php72-bcmathUpgrade php72-imapUpgrade php7-gmpUpgrade php72-tokenizerUpgrade php5-mysqlUpgrade php7-dbaUpgrade php72-pgsqlUpgrade php72-xmlrpcUpgrade php74Upgrade php5-opensslUpgrade php5-calendarUpgrade php72-snmpUpgrade php72-sysvmsgUpgrade php7-mbstringUpgrade php5-fastcgiUpgrade php7-xslUpgrade php7-imapUpgrade php74-enchantUpgrade php74-zlibUpgrade php72-curlUpgrade php74-xmlreaderUpgrade php7-sodiumUpgrade php5-soapUpgrade php5-sysvsemUpgrade php74-opensslUpgrade php7-firebirdUpgrade php7Upgrade php74-bcmathUpgrade php5-ftpUpgrade php7-posixUpgrade php72-pearUpgrade php72-bz2Upgrade php7-gettextUpgrade php5-jsonUpgrade php7-soapUpgrade php72Upgrade php74-ftpUpgrade php5-gmpUpgrade php72-mysqlUpgrade php5-odbcUpgrade php72-fpmUpgrade php72-fileinfoUpgrade php7-intlUpgrade php7-opensslUpgrade php72-wddxUpgrade php5-pharUpgrade php7-pcntlUpgrade php5-xmlwriterUpgrade php5-mcryptUpgrade php5-suhosinUpgrade php74-mbstringUpgrade php7-pear-archive_tarUpgrade php5-iconvUpgrade php5-pspellUpgrade php72-tidyUpgrade php7-socketsUpgrade php7-pspellUpgrade php7-mcryptUpgrade php5-ctypeUpgrade php74-sysvshmUpgrade php7-pharUpgrade apache2-mod_php5Upgrade php5-wddxUpgrade php72-soapUpgrade php5-enchantUpgrade php74-mysqlUpgrade php5-xmlrpcUpgrade php74-shmopUpgrade php72-odbcUpgrade php5-zlibUpgrade php7-sqliteUpgrade php7-fastcgiUpgrade php72-opensslUpgrade php74-gettextUpgrade php72-iconvUpgrade php5-xslUpgrade php72-enchantUpgrade php72-ctypeUpgrade php7-sysvmsgUpgrade php7-ctypeUpgrade php5-sysvshmUpgrade apache2-mod_php7Upgrade php74-snmpUpgrade php72-ftpUpgrade apache2-mod_php74Upgrade php72-intlUpgrade php7-odbcUpgrade php74-tidyUpgrade php74-intlUpgrade php7-wddxUpgrade php7-testUpgrade php5-tokenizerUpgrade php7-sysvsemUpgrade php7-iconvUpgrade php5-sqliteUpgrade apache2-mod_php72Upgrade php5-gdUpgrade php7-pgsqlUpgrade php7-zlibUpgrade php72-fastcgiUpgrade php5-intlUpgrade php7-shmopUpgrade php72-xmlreaderUpgrade php74-iconvUpgrade php7-jsonUpgrade php72-develUpgrade php5-curlUpgrade php7-zipUpgrade php7-ftpUpgrade php74-odbcUpgrade php7-pearUpgrade php72-socketsUpgrade php7-tokenizerUpgrade php74-sqliteUpgrade php74-develUpgrade php7-fileinfoUpgrade php7-readlineUpgrade php74-socketsUpgrade php74-pcntlUpgrade php74-fpmUpgrade php72-pspellUpgrade php72-jsonUpgrade php5-sysvmsgUpgrade php5-fpmUpgrade php72-pear-archive_tarUpgrade php5-fileinfoUpgrade php74-ldapUpgrade php74-pdoUpgrade php7-calendarUpgrade php5-exifUpgrade php74-fileinfoUpgrade php74-fastcgiUpgrade php72-ldapUpgrade php72-readlineUpgrade php74-dbaUpgrade php72-dbaUpgrade php7-snmpUpgrade php7-bcmathUpgrade php5-imapUpgrade php5-zipUpgrade php5-dbaUpgrade php72-calendarUpgrade php74-sodiumUpgrade php74-tokenizerUpgrade php74-curlUpgrade php72-gettextUpgrade php7-ldapUpgrade php5-posixUpgrade php7-xmlwriterUpgrade php72-sqliteUpgrade php7-develUpgrade php5-pearUpgrade php5-mbstringUpgrade php74-posixUpgrade php7-enchantUpgrade php5-domUpgrade php5-socketsUpgrade php7-mysqlUpgrade php72-pharUpgrade php72-gmpUpgrade php5-ldapUpgrade php5-pgsql | Sep 2, 2020 | Jul 6, 2020 |
| Ubuntu | — | Upgrade libapache2-mod-php7.0 (Ubuntu Pro)Upgrade php5-cgi (Ubuntu Pro)Upgrade libapache2-mod-php7.2Upgrade php7.0-fpm (Ubuntu Pro)Upgrade php7.0-cgi (Ubuntu Pro)Upgrade php7.2-cgiUpgrade php7.4-cgiUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php7.2-fpmUpgrade php7.2-cliUpgrade libapache2-mod-php7.4Upgrade php7.4-fpmUpgrade php7.4-cliUpgrade php7.0-cli (Ubuntu Pro)Upgrade php5-cli (Ubuntu Pro)Upgrade php5-fpm (Ubuntu Pro) | Jul 8, 2021 | Jul 6, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub