CVE-2017-5677 PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression.
CriticalCVSS 9.8
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pear html ajax | = 0.3.0 | No fix listed |
| pear html ajax | = 0.3.1 | No fix listed |
| pear html ajax | = 0.3.2 | No fix listed |
| pear html ajax | = 0.3.3 | No fix listed |
| pear html ajax | = 0.3.4 | No fix listed |
| pear html ajax | = 0.4.0 | No fix listed |
| pear html ajax | = 0.4.1 | No fix listed |
| pear html ajax | = 0.5.0 | No fix listed |
| pear html ajax | = 0.5.1 | No fix listed |
| pear html ajax | = 0.5.2 | No fix listed |
| pear html ajax | = 0.5.3 | No fix listed |
| pear html ajax | = 0.5.4 | No fix listed |
| pear html ajax | = 0.5.5 | No fix listed |
| pear html ajax | = 0.5.6 | No fix listed |
| pear html ajax | = 0.5.7 | No fix listed |
References
- blog.pear.php.net vendor-advisory
- karmainsecurity.com third-party-advisory
- seclists.org mailing-list third-party-advisory
- 96044 third-party-advisory vdb-entry
- gitweb.gentoo.org third-party-advisory
- pear.php.net vendor-advisory