Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : PEAR vulnerability (USN-4723-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4723-1 advisory. It was discovered that PEAR incorrectly handled symbolic links in archives. A remote attacker could possibly use this issue to execute...

EulerOS 2.0 SP8 : php-pear (EulerOS-SA-2021-1164)

According to the versions of the php-pear package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.CVE-2020-28948 - ArchiveTar throug...

MGASA-2021-0060 Updated php-pear packages fix a security vulnerability

The updated php-pear packages fix a security vulnerability in component Archivetar, a symlink out-of-path write vulnerability. Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links. CVE-2020-36193...

Updated php-pear packages fix a security vulnerability

The updated php-pear packages fix a security vulnerability in component Archivetar, a symlink out-of-path write vulnerability. Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links. CVE-2020-36193...

Metasploit Wrap-Up

MobileIron MDM Hessian-Based Java Deserialization RCE Our very own wvu-r7 has added exploits/linux/http/mobileironmdmhessianrce, which exploits an ACL bypass in MobileIron MDM products to execute a Java deserialization attack using a Groovy gadget against a Hessian based endpoint. CVE-2020-15505...

Fedora: Security Advisory for php-pear (FEDORA-2021-dc7de65eed)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for php-pear (FEDORA-2021-02996612f6)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 33 Update: php-pear-1.10.12-5.fc33

PEAR is a framework and distribution system for reusable PHP components. This package contains the basic PEAR components...

Fedora 33 : 1:php-pear (2021-dc7de65eed)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-dc7de65eed advisory. - Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to...

[SECURITY] Fedora 32 Update: php-pear-1.10.12-5.fc32

PEAR is a framework and distribution system for reusable PHP components. This package contains the basic PEAR components...

Fedora 32 : 1:php-pear (2021-02996612f6)

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-02996612f6 advisory. - Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to...

PEAR Archive_Tar: Directory traversal

Background This class provides handling of tar files in PHP. Description Multiple vulnerabilities have been discovered in PEAR ArchiveTar. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

GLSA-202101-23 : PEAR Archive_Tar: Directory traversal

The remote host is affected by the vulnerability described in GLSA-202101-23 PEAR ArchiveTar: Directory traversal Multiple vulnerabilities have been discovered in PEAR ArchiveTar. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers...

Drupal 8.9.x < 8.9.13 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

Drupal 9.0.x < 9.0.11 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

Drupal 9.1.x < 9.1.3 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

Drupal 7.x < 7.78 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.78, 8.9.x prior to 8.9.13, 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.3. It is, therefore, affected by a directory traversal due to the PEAR ArchiveTar library used by Drupal. The...

EulerOS 2.0 SP3 : php-pear (EulerOS-SA-2021-1111)

According to the version of the php-pear package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack such as file:// to...

Huawei EulerOS: Security Advisory for php-pear (EulerOS-SA-2021-1111)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Pear Archive_Tar Backlink Vulnerability

Pear ArchiveTar is a Php-based software from the Pear PEAR team that allows for the creation, extraction, etc. of tarballs. ArchiveTar through 1.4.11 suffers from a backlink vulnerability that allows write operations via directory traversal...