PT-2019-1894 · Php+7 · Php+7
Publicado
2019-01-17
·
Atualizado
2024-06-15
·
CVE-2019-9021
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.6.40
PHP versions 7.x prior to 7.1.26
PHP versions 7.2.x prior to 7.2.14
PHP versions 7.3.x prior to 7.3.1
Description
The issue is related to a heap-based buffer over-read in PHAR reading functions in the PHAR extension. This may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, potentially leading to a denial of service, confidentiality, and integrity breaches. The vulnerability is associated with the
phar detect phar fname ext function in ext/phar/phar.c.Recommendations
For PHP versions prior to 5.6.40, update to version 5.6.40 or later.
For PHP versions 7.x prior to 7.1.26, update to version 7.1.26 or later.
For PHP versions 7.2.x prior to 7.2.14, update to version 7.2.14 or later.
For PHP versions 7.3.x prior to 7.3.1, update to version 7.3.1 or later.
Exploit
Correção
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Php
Red Hat
Rocky Linux
Suse
Ubuntu