CVE-2018-5712 An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar f...
MediumCVSS 6.1
EPSS 79.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | <= 5.6.32 | No fix listed |
| PHP | >= 7.0.0, <= 7.0.26 | No fix listed |
| PHP | >= 7.1.0, <= 7.1.12 | No fix listed |
| PHP | = 7.2.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| alpine/php5(Alpine:v3.4) | < 5.6.36-r0 | 5.6.36-r0 |
| alpine/php5(Alpine:v3.5) | < 5.6.36-r0 | 5.6.36-r0 |
| alpine/php5(Alpine:v3.6) | < 5.6.36-r0 | 5.6.36-r0 |
| alpine/php5(Alpine:v3.7) | < 5.6.36-r0 | 5.6.36-r0 |
| alpine/php5(Alpine:v3.8) | < 5.6.36-r0 | 5.6.36-r0 |
| alpine/php7(Alpine:v3.10) | < 7.2.5-r0 | 7.2.5-r0 |
| alpine/php7(Alpine:v3.11) | < 7.2.5-r0 | 7.2.5-r0 |
| alpine/php7(Alpine:v3.12) | < 7.2.5-r0 | 7.2.5-r0 |
| alpine/php7(Alpine:v3.13) | < 7.2.5-r0 | 7.2.5-r0 |
| alpine/php7(Alpine:v3.14) | < 7.2.5-r0 | 7.2.5-r0 |
| alpine/php7(Alpine:v3.15) | < 7.2.5-r0 | 7.2.5-r0 |
| alpine/php7(Alpine:v3.5) | < 7.0.30-r0 | 7.0.30-r0 |
| alpine/php7(Alpine:v3.6) | < 7.1.17-r0 | 7.1.17-r0 |
| alpine/php7(Alpine:v3.7) | < 7.1.29-r0 | 7.1.29-r0 |
| alpine/php7(Alpine:v3.8) | < 7.2.5-r0 | 7.2.5-r0 |
| alpine/php7(Alpine:v3.9) | < 7.2.5-r0 | 7.2.5-r0 |
References
- php.net release-notes vendor-advisory
- php.net release-notes vendor-advisory
- 102742 third-party-advisory vdb-entry
- 104020 third-party-advisory vdb-entry
- 1040363 third-party-advisory vdb-entry
- RHSA-2018:1296 third-party-advisory vendor-advisory
- RHSA-2019:2519 vendor-advisory
- bugs.php.net issue-tracking patch vendor-advisory
- [debian-lts-announce] 20180120 [SECURITY] [DLA 1251-1] php5 security update mailing-list third-party-advisory
- USN-3566-1 third-party-advisory vendor-advisory
- USN-3600-1 third-party-advisory vendor-advisory
- USN-3600-2 third-party-advisory vendor-advisory
- www.oracle.com
- security.alpinelinux.org vendor-advisory