208 matches found
Archive_Tar: directory traversal due to inadequate checking of symbolic links
A flaw was found in the ArchiveTar package. ArchiveTar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences /../ to modify...
RLSA-2022:6542 Moderate: php:7.4 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: ArchiveTar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked CVE-2020-28948 ArchiveTar: improper filename sanitization leads to file overwrites CVE-2020-28949...
RHEL 8 : php:7.4 (RHSA-2022:6542)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6542 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: ArchiveTar: allows an unserialization...
SUSE SLES15 Security Update : php8-pear (SUSE-SU-2022:3198-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3198-1 advisory. - Add php8-pear to SLE15-SP4 jscSLE-24728 - Update to 1.10.21 - PEAR 1.10.13 unsupported protocol - use --force to continue Add $this operat...
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
PEAR ArchiveTar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drup...
PEAR::Archive_Tar Directory Traversal vulnerability
Directory traversal vulnerability in PEAR::ArchiveTar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive...
Mageia: Security Advisory (MGASA-2021-0393)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
The vulnerability of the Archive_Tar package in the PHP classes of the PEAR CMS system, allowing attackers to compromise the integrity, accessibility, and confidentiality of data.
The vulnerability of the ArchiveTar package in the PHP classes of the PEAR CMS system, Drupal, is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow an attacker to compromise the integrity, accessibility, and confidentiality of data...
The vulnerability of the Tar.php file in the Archive_Tar package of the PHP PEAR library arises from an improper restriction on the path name of the directory. This allows a attacker to compromise data integrity.
The vulnerability of the Tar.php file in the ArchiveTar package from the PHP PEAR library is related to improper handling of symbolic links. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...
Nextcloud Server shipped insecure Archive_Tar version
None...
Huawei EulerOS: Security Advisory for php-pear (EulerOS-SA-2021-2480)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP8 : php-pear (EulerOS-SA-2021-2480)
According to the versions of the php-pear package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193...
Amazon Linux 2 : php-pear (ALAS-2021-1708)
The version of php-pear installed on the remote host is prior to 1.10.12-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1708 advisory. In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than...
OPENSUSE-SU-2021:3018-1 Security update for php7-pear
This update for php7-pear fixes the following issues: - CVE-2020-36193: Fixed ArchiveTar directory traversal due to inadequate checking of symbolic links bsc1189591...
SUSE: Security Advisory (SUSE-SU-2021:3006-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE-SU-2021:3006-1 Security update for php74-pear
This update for php74-pear fixes the following issues: - CVE-2020-36193: Fixed ArchiveTar directory traversal due to inadequate checking of symbolic links bsc1189591...
SUSE SLED12: apache2-mod_php72 / php72 / php72-bcmath / php72-bz2 / etc (SUSE-SU-2021:2926-1)
The remote SUSE Linux SLED12 / SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2926-1 advisory. - CVE-2020-36193: Fixed ArchiveTar directory traversal due to inadequate checking of symbolic links bsc1189591. Tenable has extracted the...
SUSE-SU-2021:2926-1 Security update for php72
This update for php72 fixes the following issues: - CVE-2020-36193: Fixed ArchiveTar directory traversal due to inadequate checking of symbolic links bsc1189591...
OPENSUSE-SU-2021:2872-1 Security update for php7
This update for php7 fixes the following issues: - CVE-2020-36193: Fixed ArchiveTar directory traversal due to inadequate checking of symbolic links bsc1189591...