Lucene search

[email protected]CVE-2011-1072

HistoryMar 03, 2011 - 1:00 a.m.

CVE-2011-1072

2011-03-0301:00:01

CWE-59

[email protected]

web.nvd.nist.gov

cve-2011-1072

pear

installer

symlink attack

vulnerability

nvd

3.3 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:P/A:P

8.5 High

AI Score

Confidence

High

0.06 Low

EPSS

Percentile

93.5%

JSON

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories, a different vulnerability than CVE-2007-2519.

Affected configurations

NVD

Node

phppearRange≤1.9.1

phppearMatch0.2.2

phppearMatch0.9

phppearMatch0.10

phppearMatch0.11

phppearMatch0.90

phppearMatch1.0

phppearMatch1.0.1

phppearMatch1.1

phppearMatch1.2

phppearMatch1.2.1

phppearMatch1.3

phppearMatch1.3.1

phppearMatch1.3.3

phppearMatch1.3.3.1

phppearMatch1.3.4

phppearMatch1.3.5

phppearMatch1.3.6

phppearMatch1.4.0

phppearMatch1.4.0rc1

phppearMatch1.4.0rc2

phppearMatch1.4.1

phppearMatch1.4.2

phppearMatch1.5.0

phppearMatch1.5.1

phppearMatch1.6.1

CPENameOperatorVersion
php:pearphp pearle1.9.1
php:pearphp peareq0.2.2
php:pearphp peareq0.9
php:pearphp peareq0.10
php:pearphp peareq0.11
php:pearphp peareq0.90
php:pearphp peareq1.0
php:pearphp peareq1.0.1
php:pearphp peareq1.1
php:pearphp peareq1.2

CPE	Name	Operator	Version
php:pear	php pear	le	1.9.1
php:pear	php pear	eq	0.2.2
php:pear	php pear	eq	0.9
php:pear	php pear	eq	0.10
php:pear	php pear	eq	0.11
php:pear	php pear	eq	0.90
php:pear	php pear	eq	1.0
php:pear	php pear	eq	1.0.1
php:pear	php pear	eq	1.1
php:pear	php pear	eq	1.2