Skip to content
OpenAdvisories
High USN-3857-1 1 CVE

php-pear vulnerability

Published Jan 14, 2019 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Fariskhi Vidyan discovered that PEAR Archive_Tar incorrectly handled
certain archive paths. A remote attacker could possibly use this issue to
execute arbitrary code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS php-pear 1:1.10.1+submodules+notgz-6ubuntu0.1
Ubuntu · 18.04 LTS 18.04:LTS php-pear 1:1.10.5+submodules+notgz-1ubuntu1.18.04.1

Vulnerabilities 1

  • High 8.8
    CVE-2018-1000888 Public exploit EPSS 19%

    Archive_Tar contains Potential RCE if filename starts with phar://

    PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…

    drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist

References

  • report
    https://ubuntu.com/security/CVE-2018-1000888