CVE-2017-5630 PEAR core file overwrite vulnerability
HighCVSS 7.5
EPSS 12.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pear/pear(Packagist) | <= 1.10.1 | No fix listed |
| debian/php-pear(Debian:12) | All versions | No fix listed |
| debian/php-pear(Debian:12) | = 1:1.10.13+submodules+notgz+2022032202-2 | No fix listed |
| debian/php-pear(Debian:12) | = 1:1.10.16+submodules+notgz-1 | No fix listed |
| debian/php-pear(Debian:12) | = 1:1.10.16+submodules+notgz-2 | No fix listed |
| debian/php-pear(Debian:12) | = 1:1.10.16+submodules+notgz-3 | No fix listed |
| debian/php-pear(Debian:13) | All versions | No fix listed |
| debian/php-pear(Debian:13) | = 1:1.10.16+submodules+notgz-3 | No fix listed |
| debian/php-pear(Debian:14) | All versions | No fix listed |
| debian/php-pear(Debian:14) | = 1:1.10.16+submodules+notgz-3 | No fix listed |
| php pear | = 1.10.1 | No fix listed |
| ubuntu/php-pear(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/php-pear(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/php-pear(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/php-pear(Ubuntu:22.04) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2017-5630 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- vimeo.com
- web.archive.org
- 41185 exploit third-party-advisory vdb-entry
- hyp3rlinx.altervista.org
- pear.php.net vendor-advisory
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- 95882 third-party-advisory vdb-entry