PEAR Archive_Tar: Remote code execution vulnerability

Background

This class provides handling of tar files in PHP.

Description

An issue was discovered in the PEAR module Archive_Tar’s handling of file paths within Tar achives.

Impact

A local or remote attacker could possibly execute arbitrary code with the privileges of the process.

Workaround

Avoid handling untrusted Tar files with this package until you have upgraded to a non-vulnerable version.

Resolution

All PEAR-Archive_Tar users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-php/PEAR-Archive_Tar-1.4.5"