Package · Packagist

pear/archive_tar

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

High 7.8

CVE-2020-28948 Public exploit EPSS 47%

Multiple vulnerabilities through filename manipulation in Archive_Tar

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist

Nov 19, 2020
High 8.8

CVE-2018-1000888 Public exploit EPSS 19%

Archive_Tar contains Potential RCE if filename starts with phar://

PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…

drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist

Dec 27, 2018