[SECURITY] Fedora 38 Update: composer-2.6.5-1.fc38

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

[SECURITY] Fedora 37 Update: composer-2.6.5-1.fc37

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

Fedora 38 : composer (2023-f3dedfef46)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-f3dedfef46 advisory. Version 2.6.5 - 2023-10-06 Fixed error when vendor dir contains broken symlinks 11670 Fixed composer.lock missing from Composer's zip archives 11674...

Fedora 37 : composer (2023-275c12e496)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-275c12e496 advisory. Version 2.6.5 - 2023-10-06 Fixed error when vendor dir contains broken symlinks 11670 Fixed composer.lock missing from Composer's zip archives 11674...

armada-airflow (=0.5.4), jefferson-street-composer (>=1.2.0 <=1.7.1) potentially affected by CVE-2023-45348 via apache-airflow (=2.7.1)

apache-airflow PYPI version =2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - armada-airflow =0.5.4 - jefferson-street-composer =1.2.0, =1.7.1 Source cves: CVE-2023-45348 Source advisory: OSV:GHSA-FPXX-XV4C-GX...

Balada Injector A Large-Scale Malware Campaign Targeting WordPress

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In September 2023, over 17,000 WordPress websites fell victim to a malware called Balada Injector. The substantial surge in attacks is linked to the exploitation of a recently disclosed security...

armada-airflow (=0.5.4), jefferson-street-composer (>=1.2.0 <=1.7.1) potentially affected by CVE-2023-45348 via apache-airflow (=2.7.1)

apache-airflow PYPI version =2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - armada-airflow =0.5.4 - jefferson-street-composer =1.2.0, =1.7.1 Source cves: CVE-2023-45348 Source advisory: OSV:PYSEC-2023-204...

Over 17,000 WordPress Sites Compromised by Balada Injector in September 2023

More than 17,000 WordPress websites have been compromised in the month of September 2023 with a malware known as Balada Injector, nearly twice the number of detections in August. Of these, 9,000 of the websites are said to have been infiltrated using a recently disclosed security flaw in the tagD...

SUSE SLES15 / openSUSE 15 Security Update : php-composer2 (SUSE-SU-2023:4041-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4041-1 advisory. - CVE-2023-43655: Fixed a remote code execution issue that could be triggered if users published a web-accessible composer.pha...

Remote Code Execution (RCE)

Composer is vulnerable to Remote Code Execution. This vulnerability is due when the composer.phar file is published to a publicly-accessible server and registerargcargv is enabled in php.ini. This can allow an attacker to execute remote code in the server...

SUSE CVE-2023-43655

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...

Remote Code Execution (RCE)

composer/composer is vulnerable to Remote Code Execution RCE. The vulnerability exists because the registerargcargv is not properly disabled in php.ini, which allows an attacker to inject and execute malicious code through the malicious composer.phar file when publishing a composer.phar to a publ...

GHSA-JM6M-4632-36HF Composer Remote Code Execution vulnerability via web-accessible composer.phar

Impact Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has registerargcargv enabled in php.ini. Patches 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Workarounds Make sure registerargcargv i...

CVE-2023-43655

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...

DEBIAN-CVE-2023-43655

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...

UBUNTU-CVE-2023-43655

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...

CVE-2023-43655

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...

Remote code execution

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...

CVE-2023-43655 Remote Code Execution via web-accessible composer.phar

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...

CVE-2023-43655

CVE-2023-43655 affects the PHP dependency manager Composer when a user publishes a web-accessible composer.phar that can be executed as PHP and PHP is configured with register_argc_argv enabled . Multiple connected advisories confirm the vulnerability exists in Composer and describe that versions...