[20190502] - Core - By-passing protection of Phar Stream Wrapper Interceptor

In Joomla 3.9.3, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the Joomla core. In order to intercept file invocations like fileexists or stat on compromised Phar archives the base name has to be determined and...

Fedora Update for php-typo3-phar-stream-wrapper2 FEDORA-2019-6a0717dc9a

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 28 : drupal8 / php-typo3-phar-stream-wrapper2 (2019-6a0717dc9a)

drupal8 Upstream : - https://www.drupal.org/project/drupal/releases/8.6.10 - https://www.drupal.org/SA-CORE-2019-003 - https://www.drupal.org/project/drupal/releases/8.6.9 - https://www.drupal.org/project/drupal/releases/8.6.8 - https://www.drupal.org/project/drupal/releases/8.6.7 -...

[SECURITY] Fedora 29 Update: php-typo3-phar-stream-wrapper2-2.0.1-1.fc29

Interceptors for PHP's native phar:// stream handling v2. Autoloader: /usr/share/php/TYPO3/PharStreamWrapper2/autoload.php...

[SECURITY] Fedora 28 Update: php-typo3-phar-stream-wrapper2-2.0.1-1.fc28

Interceptors for PHP's native phar:// stream handling v2. Autoloader: /usr/share/php/TYPO3/PharStreamWrapper2/autoload.php...

Joomla! objection injection attack vulnerability

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A vulnerability exists in Joomla! versions prior to 3.9.3 that can be exploited b...

CVE-2019-7743

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism such as the TYPO3 PHAR stream wrapper to prevent use of the phar:// handler for non .phar-files...

CVE-2019-7743

Joomla! before 3.9.3 is vulnerable to an object injection via the phar:// stream wrapper due to a missing protection against using phar:// for non-.phar files. Affected component is the core Joomla! PHP handling (phar wrapper); exploitation could lead to severe impact (high/critical in CVSS terms...

Debian DLA-1659-1 : drupal7 security update

A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing file operations on insufficiently validated user input, thereby being exposed to this...

Debian: Security Advisory (DLA-1659-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Code Execution (RCE)

drupal/core is vulnerable to remote code execution RCE. A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. The vulnerability extends to drupal/core as the application does not sufficiently validate user...

CVE-2019-6339

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing fi...

Remote code execution

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing fi...

UBUNTU-CVE-2019-6339

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing fi...

[20190206] - Core - Implement the TYPO3 PHAR stream wrapper

The phar:// stream wrapper can be used for objection injection attacks. We now disallow usage of the phar:// handler for non .phar-files within the CMS globally by implementing the TYPO3 PHAR stream wrapper...

DRUPAL-CORE-2019-002

A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing file operations on insufficiently validated user input, thereby being exposed to this...

drupal -- Drupal core - Arbitrary PHP code execution

Drupal Security Team reports: A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing file operations on insufficiently validated user input, thereb...

UBUNTU-CVE-2018-20148

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wpgetattachmentthumbfile function in wp-includes/post.php...

WordPress Core Phar Insecure Deserialization

An insecure deserialization vulnerability exists in WordPress core. The vulnerability is due to the lack of input validation in PHP phar stream wrapper. Successful exploitation of this vulnerability could allow a remote authenticated attacker with at least author-level privileges to execute...

Vulnerabilities in Magento Community Edition and Enterprise Edition

Magento is a professional open-source PHP e-commerce system from Magento, which provides rights management, search engine and payment gateway, etc. Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. A security vulnerability exists in the...