42 matches found
RHEL 8 : php:7.4 (RHSA-2022:6542)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6542 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: ArchiveTar: allows an unserialization...
CentOS 8 : php:7.4 (CESA-2022:6542)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:6542 advisory. - ArchiveTar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked CVE-2020-28948 - ArchiveTar: improper filename...
Moderate: php:7.4 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: ArchiveTar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked CVE-2020-28948 ArchiveTar: improper filename sanitization leads to file overwrites CVE-2020-28949...
CVE-2021-38585
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks SEC-585...
CVE-2021-38585
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks SEC-585...
Deserialization of Untrusted Data in Archive_Tar
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. See: https://github.com/pear/ArchiveTar/issues/33...
Huawei EulerOS: Security Advisory for php-pear (EulerOS-SA-2021-1164)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux AMI : php7-pear (ALAS-2021-1466)
The version of php7-pear installed on the remote host is prior to 1.10.12-4.30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1466 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
Medium: php-pear
Issue Overview: ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. CVE-2020-28948 ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack such as file:// to overwrite...
Amazon Linux 2 : php-pear (ALAS-2021-1584)
The version of php-pear installed on the remote host is prior to 1.10.12-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1584 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
CVE-2020-28948
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
CVE-2020-28948
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
DEBIAN-CVE-2020-28948
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
CVE-2020-28948
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
CVE-2020-28948
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
UBUNTU-CVE-2020-28948
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
CVE-2020-28948
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
CVE-2020-28948
CVE-2020-28948 affects Archive_Tar (PHP PEAR) up to version 1.4.10/1.4.11, where an unserialization flaw occurs because phar: is blocked but PHAR: is not blocked. This can enable write operations via directory traversal when processing crafted archives (documented as a related vulnerability to CV...
