CVE-2018-1000888

CVE-2018-1000888 affects the PEAR Archive_Tar library (versions 1.4.3 and earlier). The vulnerability arises from unsafe file operations using $v_header['filename'] during extract, which can trigger phar:// based unserialization. This enables PHP object injection and can lead to destructor/wakeup...

CVE-2018-1000888

PEAR ArchiveTar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the ArchiveTar class. There are several file operations with $vheader'filename' as parameter such as fileexists, isfile, isdir, etc. When extract is called without a specific prefix path, we can trigger...

openSUSE Security Update : php7 (openSUSE-2017-994)

This update for php7 fixes the following issues : - CVE-2016-10397: parseurl can be bypassed to return fake host. bsc1047454 - CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/phpvariables. bsc1048100 -...

Oracle Linux 4 : php (ELSA-2008-0545)

From Red Hat Security Advisory 2008:0545 : Updated php packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting...

php-pear security and bug fix update

1.9.4-4 - fix patch application for 747361 1.9.4-3 - ignore REST cache creation failures as non-root user 747361 1.9.4-2 - fix XML-Util provides 1.9.4-1 - update to 1.9.4 651897 - update XMLRPC to 1.5.4, StructuresGraph to 1.0.4, ArchiveTar to 1.3.7 1.9.1-1 - update to 1.9.1 651897 - fix...

CVE-2006-0931

Directory traversal vulnerability in PEAR::ArchiveTar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive...

Directory traversal

Directory traversal vulnerability in PEAR::ArchiveTar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive...

CVE-2006-0931

Directory traversal vulnerability in PEAR::ArchiveTar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive...

CVE-2006-0931

CVE-2006-0931 affects PEAR::Archive_Tar 1.2 and other versions before 1.3.2. A directory traversal vulnerability allows remote attackers to create and overwrite arbitrary files via crafted pathnames in a TAR archive. Affected component: Archive_Tar.Impact is confirmed as directory traversal; no e...

Archive_Tar v 1.2(Tested) (Tar file management class) Directory traversal

ArchiveZipr Zip file management class Directory traversal This class provides handling of tar files in PHP. It supports creating, listing, extracting and adding to tar files. Gzip support is available if PHP has the zlib extension built-in or loaded. Bz2 compression is also supported with the bz2...