EulerOS 2.0 SP5 : php-pear (EulerOS-SA-2019-1147)

According to the version of the php-pear package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - PEAR ArchiveTar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the ArchiveTar class. There are several file operations wit...

[SECURITY] [DLA 1685-1] drupal7 security update

Package : drupal7 Version : 7.32-1+deb8u15 CVE ID : CVE-2019-6338 Drupal core uses the third-party PEAR ArchiveTar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details. Also a possible regression caused by CVE-2019-63...

Debian DLA-1685-1 : drupal7 security update

Drupal core uses the third-party PEAR ArchiveTar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details. Also a possible regression caused by CVE-2019-6339 is fixed. For Debian 8 'Jessie', this problem has been fixed in...

Debian: Security Advisory (DLA-1685-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2 : php-pear (ALAS-2019-1159)

PEAR ArchiveTar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the ArchiveTar class. There are several file operations with $vheader'filename' as parameter such as fileexists, isfile, isdir, etc. When extract is called without a specific prefix path, we can trigger...

Debian DSA-4378-1 : php-pear - security update

Fariskhi Vidyan discovered that the PEAR ArchiveTar package for handling tar files in PHP is prone to a PHP object injection vulnerability, potentially allowing a remote attacker to execute arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

[SECURITY] [DSA 4378-1] php-pear security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4378-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 30, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4378-1] php-pear security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4378-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 30, 2019 https://www.debian.org/security/faq -...

DSA-4378-1 php-pear - security update

Bulletin has no description...

Debian: Security Advisory (DSA-4378-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2019-0049 Updated php-pear-HTML_QuickForm package fixes security vulnerability

A vulnerability in the HTMLQuickForm package has been found which potentially allows remote code execution...

Updated php-pear-HTML_QuickForm package fixes security vulnerability

A vulnerability in the HTMLQuickForm package has been found which potentially allows remote code execution...

Someone Hacked PHP PEAR Site and Replaced the Official Package Manager

Beware! If you have downloaded PHP PEAR package manager from its official website in past 6 months, we are sorry to say that your server might have been compromised. Last week, the maintainers at PEAR took down the official website of the PEAR pear-php.net after they found that someone has replac...

Someone Hacked PHP PEAR Site and Replaced the Official Package Manager

Beware! If you have downloaded PHP PEAR package manager from its official website in past 6 months, we are sorry to say that your server might have been compromised. Last week, the maintainers at PEAR took down the official website of the PEAR pear-php.net after they found that someone has replac...

Object Injection

drupal/core is vulnerable to object injection. The vulnerability is possible because it does not properly use third-party PEAR ArchiveTar library, leading to a vulnerability similar to CVE-2018-1000888...

CVE-2019-6338

CVE-2019-6338 maps to the same underlying issue as CVE-2018-1000888 in the PEAR Archive_Tar library used by Drupal Core. Connected sources describe a PHP object-injection vulnerability in Archive_Tar before 1.4.4, where certain file operations (e.g., file_exists, is_file, is_dir) combined with ex...

CVE-2019-6338

Removed by vendor...

CVE-2019-6338

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR ArchiveTar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details...

CVE-2019-6338

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR ArchiveTar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details...

CVE-2019-6338

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR ArchiveTar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details...