Summary
It was discovered that PEAR incorrectly handled symbolic links in archives.
A remote attacker could possibly use this issue to execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | php-pear | 1:1.10.5+submodules+notgz-1ubuntu1.18.04.4 |
| Ubuntu · 20.04 LTS 20.04:LTS | php-pear | 1:1.10.9+submodules+notgz-1ubuntu0.20.04.3 |
Vulnerabilities 1
-
High 7.1CVE-2021-32610 EPSS 73%
Directory Traversal in Archive_Tar
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
References
-
report
https://ubuntu.com/security/CVE-2021-32610