CVE-2007-2519 Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attrib...
MediumCVSS 6.8
EPSS 7.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php pear | = 1.0 | No fix listed |
| php pear | = 1.0.1 | No fix listed |
| php pear | = 1.1 | No fix listed |
| php pear | = 1.2 | No fix listed |
| php pear | = 1.2.1 | No fix listed |
| php pear | = 1.2b1 | No fix listed |
| php pear | = 1.2b2 | No fix listed |
| php pear | = 1.2b3 | No fix listed |
| php pear | = 1.2b4 | No fix listed |
| php pear | = 1.2b5 | No fix listed |
| php pear | = 1.3 | No fix listed |
| php pear | = 1.3.1 | No fix listed |
| php pear | = 1.3.3 | No fix listed |
| php pear | = 1.3.3.1 | No fix listed |
| php pear | = 1.3.4 | No fix listed |
| php pear | = 1.3.5 | No fix listed |
| php pear | = 1.3.6 | No fix listed |
| php pear | = 1.3b1 | No fix listed |
| php pear | = 1.3b2 | No fix listed |
| php pear | = 1.3b3 | No fix listed |
| php pear | = 1.3b5 | No fix listed |
| php pear | = 1.3b6 | No fix listed |
| php pear | = 1.4.0 | No fix listed |
| php pear | = 1.4.0a1 | No fix listed |
| php pear | = 1.4.0a2 | No fix listed |
Show 34 more
| Product | Affected versions | Fixed in |
|---|---|---|
| php pear | = 1.4.0a3 | No fix listed |
| php pear | = 1.4.0a4 | No fix listed |
| php pear | = 1.4.0a5 | No fix listed |
| php pear | = 1.4.0a6 | No fix listed |
| php pear | = 1.4.0a7 | No fix listed |
| php pear | = 1.4.0a8 | No fix listed |
| php pear | = 1.4.0a9 | No fix listed |
| php pear | = 1.4.0a10 | No fix listed |
| php pear | = 1.4.0a11 | No fix listed |
| php pear | = 1.4.0a12 | No fix listed |
| php pear | = 1.4.0b1 | No fix listed |
| php pear | = 1.4.0b2 | No fix listed |
| php pear | = 1.4.0rc1 | No fix listed |
| php pear | = 1.4.0rc2 | No fix listed |
| php pear | = 1.4.1 | No fix listed |
| php pear | = 1.4.2 | No fix listed |
| php pear | = 1.4.3 | No fix listed |
| php pear | = 1.4.4 | No fix listed |
| php pear | = 1.4.5 | No fix listed |
| php pear | = 1.4.6 | No fix listed |
| php pear | = 1.4.7 | No fix listed |
| php pear | = 1.4.8 | No fix listed |
| php pear | = 1.4.9 | No fix listed |
| php pear | = 1.4.10 | No fix listed |
| php pear | = 1.4.10rc1 | No fix listed |
| php pear | = 1.4.11 | No fix listed |
| php pear | = 1.5.0 | No fix listed |
| php pear | = 1.5.0a1 | No fix listed |
| php pear | = 1.5.0rc1 | No fix listed |
| php pear | = 1.5.0rc2 | No fix listed |
| php pear | = 1.5.0rc3 | No fix listed |
| php pear | = 1.5.1 | No fix listed |
| php pear | = 1.5.2 | No fix listed |
| php pear | = 1.5.3 | No fix listed |
References
- 42108 vdb-entry
- pear.php.net exploit patch vendor-advisory
- pear.php.net
- 25372 third-party-advisory
- MDKSA-2007:110 vendor-advisory
- 24111 vdb-entry
- USN-462-1 vendor-advisory
- ADV-2007-1926 vdb-entry
- pear-installer-file-overwrite(34482) vdb-entry