Remote Code Execution (RCE)

🗓️ 02 Oct 2023 18:25:22Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 27 Views

composer/composer RCE vulnerability due to register_argc_argv not disabled in php.in

Reporter	Title	Published	Views	Family All 57
FreeBSD	Remote Code Execution via web-accessible composer	29 Sep 202300:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : composer (ALAS2023-2023-384)	24 Oct 202300:00	–	nessus
Tenable Nessus	Debian dla-3777 : composer - security update	27 Mar 202400:00	–	nessus
Tenable Nessus	Fedora 37 : composer (2023-275c12e496)	15 Oct 202300:00	–	nessus
Tenable Nessus	Fedora 39 : composer (2023-d5ab1f0b44)	7 Nov 202300:00	–	nessus
Tenable Nessus	Fedora 38 : composer (2023-f3dedfef46)	15 Oct 202300:00	–	nessus
Tenable Nessus	FreeBSD : Remote Code Execution via web-accessible composer (33922b84-5f09-11ee-b63d-0897988a1c07)	29 Sep 202300:00	–	nessus
Tenable Nessus	GLSA-202508-06 : Composer: Multiple Vulnerabilities	6 Aug 202500:00	–	nessus
Tenable Nessus	SUSE SLES15 / openSUSE 15 Security Update : php-composer2 (SUSE-SU-2023:4041-1)	11 Oct 202300:00	–	nessus
Tenable Nessus	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:1970-1)	19 May 202600:00	–	nessus

Vulners

Node

composer composerMatch2.4.1-r0php

AND

composer composerMatch2.1.1-r0php

AND

composer composerMatch2.3.9-r0php

AND

composer composerMatch2.1.11-r0php

AND

composer composerMatch2.4.4-r0php

AND

composer composerMatch2.2.6-r0php

AND

composer composerMatch1.10.1-r0php

AND

composer composerMatch2.6.3-r0php

AND

composer composerMatch2.2.4-r0php

AND

composer composerMatch2.1.14-r0php

AND

composer composerMatch2.2.3-r0php

AND

composer composerMatch2.4.0_rc1-r0php

AND

composer composerMatch2.5.7-r0php

AND

composer composerMatch2.5.3-r1php

AND

composer composerMatch2.5.1-r0php

AND

composer composerMatch1.10.5-r0php

AND

composer composerMatch2.3.2-r0php

AND

composer composerMatch2.1.8-r0php

AND

composer composerMatch2.6.2-r0php

AND

composer composerMatch2.2.7-r0php

AND

composer composerMatch2.2.1-r0php

AND

composer composerMatch2.1.5-r0php

AND

composer composerMatch1.9.3-r0php

AND

composer composerMatch2.3.10-r0php

AND

composer composerMatch2.0.12-r0php

AND

composer composerMatch2.1.6-r0php

AND

composer composerMatch2.5.5-r0php

AND

composer composerMatch2.3.7-r0php

AND

composer composerMatch2.1.3-r0php

AND

composer composerMatch2.1.9-r1php

AND

composer composerMatch2.3.5-r0php

AND

composer composerMatch2.5.4-r0php

AND

composer composerMatch2.0.11-r0php

AND

composer composerMatch2.1.9-r0php

AND

composer composerMatch2.0.14-r0php

AND

composer composerMatch2.2.5-r0php

AND

composer composerMatch2.4.3-r0php

AND

composer composerMatch2.4.2-r0php

AND

composer composerMatch2.5.8-r0php

AND

composer composerMatch2.0.13-r0php

AND

composer composerMatch1.10.6-r0php

AND

composer composerMatch1.10.0-r0php

AND

alpinelinux alpine_linuxMatchedge

composer composerMatch2.5.5-r0php

AND

composer composerMatch2.5.8-r0php

AND

alpinelinux alpine_linuxMatch3.18

composer composerMatch2.0.9-1debian

AND

composer composerMatch1.10.13-1debian

AND

composer composerMatch2.0.9-2debian

AND

debian debian_linuxMatch999

composer composerMatch1.8.4-1+deb10u1debian

AND

debian debian_linuxMatch10

composer composer/composerRange2.3.0–2.6.3php

composer composer/composerRange1.0.0-alpha1–1.10.26php

composer composer/composerRange2.0.0–2.2.21php

Source	Link
secdb	www.secdb.alpinelinux.org/edge/community.yaml
secdb	www.secdb.alpinelinux.org/v3.18/community.yaml
github	www.github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d
github	www.github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c
github	www.github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c
github	www.github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf
lists	www.lists.debian.org/debian-lts-announce/2024/03/msg00030.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2/

13 Feb 2025 19:32Current

7.5High risk

Vulners AI Score7.5

CVSS 3.16.4 - 8.8

EPSS0.01575

SSVC