In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-embeddedUpgrade apcu-panelUpgrade libzip-develUpgrade php-processUpgrade php-snmpUpgrade php-pecl-xdebugUpgrade libzip-toolsUpgrade php-bcmathUpgrade php-ldapUpgrade php-opcacheUpgrade phpUpgrade php-gdUpgrade php-xmlrpcUpgrade php-cliUpgrade php-ffiUpgrade php-mysqlndUpgrade php-xmlUpgrade php-pearUpgrade php-pecl-rrdUpgrade libzipUpgrade php-enchantUpgrade php-develUpgrade php-jsonUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade php-commonUpgrade php-mbstringUpgrade php-dbaUpgrade php-pecl-apcuUpgrade php-soapUpgrade php-odbcUpgrade php-pdoUpgrade php-dbgUpgrade php-pgsqlUpgrade php-pecl-zipUpgrade php-intlUpgrade php-gmp | May 13, 2022 | Sep 9, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Sep 9, 2020 |
| Amazon_linux | — | Upgrade php73Upgrade php72 | Sep 1, 2020 | Jul 6, 2020 |
| Centos_linux | — | Upgrade php-ffiUpgrade php-gmpUpgrade php-jsonUpgrade libzip-toolsUpgrade php-dba-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-intlUpgrade php-pecl-xdebug-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-dbgUpgrade libzip-debuginfoUpgrade php-process-debuginfoUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade php-fpm-debuginfoUpgrade apcu-panelUpgrade php-pdo-debuginfoUpgrade php-commonUpgrade php-enchant-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-cli-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-ldapUpgrade php-xml-debuginfoUpgrade php-odbc-debuginfoUpgrade php-debuginfoUpgrade php-json-debuginfoUpgrade php-odbcUpgrade php-pecl-xdebug-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-zip-debugsourceUpgrade php-dbg-debuginfoUpgrade phpUpgrade php-gd-debuginfoUpgrade php-xmlUpgrade libzipUpgrade php-xmlrpcUpgrade libzip-develUpgrade php-xmlrpc-debuginfoUpgrade php-snmpUpgrade php-pecl-rrd-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pdoUpgrade php-fpmUpgrade php-gdUpgrade php-embeddedUpgrade php-enchantUpgrade php-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-mysqlndUpgrade php-gmp-debuginfoUpgrade php-snmp-debuginfoUpgrade php-soapUpgrade php-soap-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-mbstringUpgrade php-dbaUpgrade php-pecl-zipUpgrade libzip-debugsourceUpgrade php-opcacheUpgrade php-ldap-debuginfoUpgrade php-intl-debuginfoUpgrade php-develUpgrade php-cliUpgrade php-pearUpgrade php-bcmathUpgrade php-processUpgrade php-pecl-xdebugUpgrade php-pecl-rrd | Nov 10, 2021 | Sep 9, 2020 |
| Debian | — | Upgrade php7.4 | Aug 28, 2020 | Aug 28, 2020 |
| Freebsd | — | Upgrade php72Upgrade php73Upgrade php74 | Aug 28, 2020 | Aug 27, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Sep 14, 2020 | Sep 9, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-odbcUpgrade php-fpmUpgrade php-commonUpgrade php-xmlrpcUpgrade php-processUpgrade php-cliUpgrade php-pdoUpgrade phpUpgrade php-xmlUpgrade php-soapUpgrade php-recodeUpgrade php-ldapUpgrade php-gd | Nov 3, 2020 | Sep 9, 2020 |
| Oracle_linux | — | Upgrade php-pecl-apcuUpgrade php-pgsqlUpgrade libzip-toolsUpgrade php-pecl-apcu-develUpgrade php-intlUpgrade php-mbstringUpgrade php-ldapUpgrade php-odbcUpgrade php-dbgUpgrade php-commonUpgrade php-xmlUpgrade php-fpmUpgrade php-processUpgrade php-develUpgrade php-pecl-rrdUpgrade php-gdUpgrade php-ffiUpgrade php-mysqlndUpgrade php-snmpUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-gmpUpgrade libzip-develUpgrade php-pearUpgrade php-pdoUpgrade php-enchantUpgrade php-dbaUpgrade php-opcacheUpgrade php-pecl-zipUpgrade libzipUpgrade php-jsonUpgrade php-bcmathUpgrade php-embeddedUpgrade php-soapUpgrade apcu-panelUpgrade php-cliUpgrade php | Nov 17, 2021 | Aug 6, 2020 |
| Php | — | Upgrade to PHP version 7.3.21Upgrade to PHP version 7.4.9Upgrade to PHP version 7.2.23 | Oct 5, 2020 | Sep 9, 2020 |
| Redhat_linux | — | Upgrade php-odbcUpgrade php-pecl-xdebug-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-xmlUpgrade php-pecl-xdebug-debugsourceUpgrade php-cliUpgrade libzip-debuginfoUpgrade php-json-debuginfoUpgrade php-mysqlndUpgrade php-fpmUpgrade php-pecl-rrd-debugsourceUpgrade php-opcacheNo solution existsUpgrade php-ldapUpgrade php-common-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-xdebugUpgrade php-mysqlnd-debuginfoUpgrade libzip-develUpgrade php-dbgUpgrade php-pecl-zip-debuginfoUpgrade php-dba-debuginfoUpgrade php-commonUpgrade php-pdoUpgrade php-pecl-apcu-debugsourceUpgrade php-enchant-debuginfoUpgrade php-bcmathUpgrade php-pearUpgrade php-snmpUpgrade php-ffi-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-gmp-debuginfoUpgrade php-develUpgrade php-pecl-rrd-debuginfoUpgrade php-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-enchantUpgrade php-cli-debuginfoUpgrade php-dbg-debuginfoUpgrade php-debuginfoUpgrade php-opcache-debuginfoUpgrade php-gd-debuginfoUpgrade libzipUpgrade apcu-panelUpgrade php-pecl-rrdUpgrade php-xml-debuginfoUpgrade php-ffiUpgrade php-gdUpgrade php-jsonUpgrade php-gmpUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-bcmath-debuginfoUpgrade libzip-toolsUpgrade libzip-debugsourceUpgrade php-embeddedUpgrade libzip-tools-debuginfoUpgrade php-soapUpgrade php-soap-debuginfoUpgrade php-pecl-zipUpgrade php-intl-debuginfoUpgrade php-process-debuginfoUpgrade php-intlUpgrade php-processUpgrade php-dbaUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-apcu-develUpgrade php-embedded-debuginfo | Nov 10, 2021 | Sep 9, 2020 |
| Rocky_linux | — | Upgrade php-pecl-apcu-debugsourceUpgrade php-jsonUpgrade php-mbstring-debuginfoUpgrade libzip-toolsUpgrade php-pgsqlUpgrade libzip-debugsourceUpgrade php-dbaUpgrade php-commonUpgrade php-fpm-debuginfoUpgrade php-pdoUpgrade php-pdo-debuginfoUpgrade php-gmpUpgrade php-intlUpgrade php-odbc-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade libzip-debuginfoUpgrade php-ffiUpgrade php-pecl-apcuUpgrade php-dba-debuginfoUpgrade php-process-debuginfoUpgrade php-ffi-debuginfoUpgrade php-soap-debuginfoUpgrade php-enchant-debuginfoUpgrade php-gmp-debuginfoUpgrade php-odbcUpgrade php-dbgUpgrade php-cli-debuginfoUpgrade php-soapUpgrade php-xml-debuginfoUpgrade php-pecl-apcu-develUpgrade php-common-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade phpUpgrade php-pecl-zip-debuginfoUpgrade php-bcmathUpgrade php-ldapUpgrade php-json-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-enchantUpgrade php-pecl-zip-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-apcu-debuginfoUpgrade php-embeddedUpgrade php-pecl-zipUpgrade php-intl-debuginfoUpgrade php-gd-debuginfoUpgrade php-xmlUpgrade php-opcacheUpgrade php-mysqlndUpgrade php-ldap-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-embedded-debuginfoUpgrade php-fpmUpgrade php-mbstringUpgrade php-develUpgrade php-debugsourceUpgrade php-processUpgrade php-opcache-debuginfoUpgrade php-pecl-xdebugUpgrade php-snmpUpgrade php-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-dbg-debuginfoUpgrade php-gdUpgrade libzipUpgrade php-cliUpgrade php-snmp-debuginfoUpgrade libzip-develUpgrade php-xmlrpc | Mar 12, 2024 | Sep 9, 2020 |
| Suse | — | Upgrade php5-jsonUpgrade php5-snmpUpgrade php74-ctypeUpgrade php72-snmpUpgrade php74-ftpUpgrade php74Upgrade php72-imapUpgrade php74-enchantUpgrade php74-pgsqlUpgrade php5-calendarUpgrade php5-pharUpgrade php72-posixUpgrade php74-jsonUpgrade php7-embedUpgrade php72-curlUpgrade php74-exifUpgrade php7-mbstringUpgrade php74-bz2Upgrade php7-gmpUpgrade php7-pcntlUpgrade php72-opcacheUpgrade php72-xslUpgrade php74-opensslUpgrade php5-opensslUpgrade php72-zlibUpgrade php72-zipUpgrade php74-bcmathUpgrade php5-gmpUpgrade php5-fastcgiUpgrade php7-opcacheUpgrade php72-gdUpgrade php5-pcntlUpgrade php5-pdoUpgrade php74-sysvsemUpgrade php7-opensslUpgrade php72-wddxUpgrade php74-zlibUpgrade php72-pearUpgrade php7-posixUpgrade php72-pcntlUpgrade php7-firebirdUpgrade php74-gdUpgrade php74-xmlrpcUpgrade php72-exifUpgrade php72-mbstringUpgrade php72-sysvsemUpgrade php5-bz2Upgrade php7-gdUpgrade php72-tokenizerUpgrade php7-gettextUpgrade php74-gmpUpgrade php5-ftpUpgrade php5-sysvsemUpgrade php7-sodiumUpgrade php5-gettextUpgrade php74-xmlwriterUpgrade php5-opcacheUpgrade php7-domUpgrade php7-xmlrpcUpgrade php72-fpmUpgrade php5-odbcUpgrade php72-fileinfoUpgrade php74-sysvmsgUpgrade php74-zipUpgrade php74-soapUpgrade php74-readlineUpgrade php72-sysvshmUpgrade php74-xmlreaderUpgrade php72Upgrade php72-xmlwriterUpgrade php72-bz2Upgrade php7-intlUpgrade php72-sodiumUpgrade php7-imapUpgrade php5-soapUpgrade php74-pharUpgrade php7Upgrade php7-fpmUpgrade php7-soapUpgrade php5-shmopUpgrade php7-tidyUpgrade php5-mysqlUpgrade php72-xmlrpcUpgrade php7-bz2Upgrade php7-curlUpgrade php7-exifUpgrade php5-xmlwriterUpgrade php72-pgsqlUpgrade php7-dbaUpgrade php72-bcmathUpgrade php5Upgrade php5-mcryptUpgrade php7-xslUpgrade php72-pdoUpgrade php7-sysvshmUpgrade php74-xslUpgrade php72-domUpgrade php72-mysqlUpgrade php74-opcacheUpgrade php7-pdoUpgrade php7-xmlreaderUpgrade php72-shmopUpgrade php5-bcmathUpgrade php5-xmlreaderUpgrade php72-sysvmsgUpgrade php74-calendarUpgrade php74-domUpgrade php7-zipUpgrade php5-iconvUpgrade php5-wddxUpgrade php7-wddxUpgrade php5-zlibUpgrade php74-tidyUpgrade apache2-mod_php74Upgrade php74-intlUpgrade php7-pgsqlUpgrade php72-gettextUpgrade php5-gdUpgrade php5-tokenizerUpgrade php7-xmlwriterUpgrade php5-dbaUpgrade php72-sqliteUpgrade php7-sysvmsgUpgrade php72-develUpgrade php5-curlUpgrade php7-readlineUpgrade php74-odbcUpgrade php74-sqliteUpgrade php7-pearUpgrade php74-develUpgrade php72-socketsUpgrade php7-tokenizerUpgrade php7-fileinfoUpgrade php72-intlUpgrade php7-ftpUpgrade php5-pgsqlUpgrade php7-sqliteUpgrade php74-fpmUpgrade php7-ctypeUpgrade php72-ftpUpgrade php74-snmpUpgrade php7-iconvUpgrade php7-pear-archive_tarUpgrade php72-iconvUpgrade php7-ldapUpgrade php74-tokenizerUpgrade apache2-mod_php7Upgrade php74-curlUpgrade apache2-mod_php72Upgrade php72-enchantUpgrade php7-sysvsemUpgrade php5-zipUpgrade php5-sysvmsgUpgrade php7-enchantUpgrade php7-pharUpgrade php7-jsonUpgrade php72-pharUpgrade php5-pearUpgrade php5-mbstringUpgrade apache2-mod_php5Upgrade php5-enchantUpgrade php5-domUpgrade php5-socketsUpgrade php7-mysqlUpgrade php74-sysvshmUpgrade php74-iconvUpgrade php74-posixUpgrade php74-mbstringUpgrade php72-soapUpgrade php5-intlUpgrade php72-xmlreaderUpgrade php7-zlibUpgrade php72-gmpUpgrade php7-pspellUpgrade php5-xmlrpcUpgrade php72-tidyUpgrade php5-suhosinUpgrade php5-pspellUpgrade php5-ldapUpgrade php5-ctypeUpgrade php7-socketsUpgrade php74-mysqlUpgrade php74-socketsUpgrade php74-pcntlUpgrade php72-fastcgiUpgrade php7-shmopUpgrade php7-mcryptUpgrade php72-odbcUpgrade php7-testUpgrade php72-ctypeUpgrade php74-dbaUpgrade php5-sysvshmUpgrade php72-ldapUpgrade php72-jsonUpgrade php72-readlineUpgrade php72-pear-archive_tarUpgrade php7-calendarUpgrade php7-bcmathUpgrade php5-imapUpgrade php5-fpmUpgrade php72-dbaUpgrade php72-pspellUpgrade php74-fileinfoUpgrade php74-pdoUpgrade php74-ldapUpgrade php74-fastcgiUpgrade php74-shmopUpgrade php7-snmpUpgrade php7-odbcUpgrade php74-sodiumUpgrade php5-exifUpgrade php7-develUpgrade php5-sqliteUpgrade php72-opensslUpgrade php5-posixUpgrade php74-gettextUpgrade php5-xslUpgrade php5-fileinfoUpgrade php72-calendarUpgrade php7-fastcgi | Sep 2, 2020 | Jul 6, 2020 |
| Ubuntu | — | Upgrade php5-fpm (Ubuntu Pro)Upgrade php7.4-fpmUpgrade php7.0-cli (Ubuntu Pro)Upgrade php5-cli (Ubuntu Pro)Upgrade php7.2-cliUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php7.4-cliUpgrade libapache2-mod-php7.4Upgrade php7.2-fpmUpgrade php7.0-cgi (Ubuntu Pro)Upgrade php7.2-cgiUpgrade libapache2-mod-php7.2Upgrade libapache2-mod-php7.0 (Ubuntu Pro)Upgrade php5-cgi (Ubuntu Pro)Upgrade php7.4-cgiUpgrade php7.0-fpm (Ubuntu Pro) | Jul 8, 2021 | Jul 6, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub