PT-2019-1894 · Php+7 · Php+7
Published
2019-01-17
·
Updated
2024-06-15
·
CVE-2019-9021
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.6.40
PHP versions 7.x prior to 7.1.26
PHP versions 7.2.x prior to 7.2.14
PHP versions 7.3.x prior to 7.3.1
Description
The issue is related to a heap-based buffer over-read in PHAR reading functions in the PHAR extension. This may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, potentially leading to a denial of service, confidentiality, and integrity breaches. The vulnerability is associated with the
phar detect phar fname ext function in ext/phar/phar.c.Recommendations
For PHP versions prior to 5.6.40, update to version 5.6.40 or later.
For PHP versions 7.x prior to 7.1.26, update to version 7.1.26 or later.
For PHP versions 7.2.x prior to 7.2.14, update to version 7.2.14 or later.
For PHP versions 7.3.x prior to 7.3.1, update to version 7.3.1 or later.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Php
Red Hat
Rocky Linux
Suse
Ubuntu