6.8

CVE-2007-2519

Exploit
Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0.  NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Php Group ≫ Pear Version1.0
Php Group ≫ Pear Version1.0.1
Php Group ≫ Pear Version1.1
Php Group ≫ Pear Version1.2
Php Group ≫ Pear Version1.2.1
Php Group ≫ Pear Version1.2b1
Php Group ≫ Pear Version1.2b2
Php Group ≫ Pear Version1.2b3
Php Group ≫ Pear Version1.2b4
Php Group ≫ Pear Version1.2b5
Php Group ≫ Pear Version1.3
Php Group ≫ Pear Version1.3.1
Php Group ≫ Pear Version1.3.3
Php Group ≫ Pear Version1.3.3.1
Php Group ≫ Pear Version1.3.4
Php Group ≫ Pear Version1.3.5
Php Group ≫ Pear Version1.3.6
Php Group ≫ Pear Version1.3b1
Php Group ≫ Pear Version1.3b2
Php Group ≫ Pear Version1.3b3
Php Group ≫ Pear Version1.3b5
Php Group ≫ Pear Version1.3b6
Php Group ≫ Pear Version1.4.0
Php Group ≫ Pear Version1.4.0a1
Php Group ≫ Pear Version1.4.0a2
Php Group ≫ Pear Version1.4.0a3
Php Group ≫ Pear Version1.4.0a4
Php Group ≫ Pear Version1.4.0a5
Php Group ≫ Pear Version1.4.0a6
Php Group ≫ Pear Version1.4.0a7
Php Group ≫ Pear Version1.4.0a8
Php Group ≫ Pear Version1.4.0a9
Php Group ≫ Pear Version1.4.0a10
Php Group ≫ Pear Version1.4.0a11
Php Group ≫ Pear Version1.4.0a12
Php Group ≫ Pear Version1.4.0b1
Php Group ≫ Pear Version1.4.0b2
Php Group ≫ Pear Version1.4.0rc1
Php Group ≫ Pear Version1.4.0rc2
Php Group ≫ Pear Version1.4.1
Php Group ≫ Pear Version1.4.2
Php Group ≫ Pear Version1.4.3
Php Group ≫ Pear Version1.4.4
Php Group ≫ Pear Version1.4.5
Php Group ≫ Pear Version1.4.6
Php Group ≫ Pear Version1.4.7
Php Group ≫ Pear Version1.4.8
Php Group ≫ Pear Version1.4.9
Php Group ≫ Pear Version1.4.10
Php Group ≫ Pear Version1.4.10rc1
Php Group ≫ Pear Version1.4.11
Php Group ≫ Pear Version1.5.0
Php Group ≫ Pear Version1.5.0a1
Php Group ≫ Pear Version1.5.0rc1
Php Group ≫ Pear Version1.5.0rc2
Php Group ≫ Pear Version1.5.0rc3
Php Group ≫ Pear Version1.5.1
Php Group ≫ Pear Version1.5.2
Php Group ≫ Pear Version1.5.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.29% 0.936
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://secunia.com/advisories/25372
http://www.ubuntu.com/usn/usn-462-1
http://osvdb.org/42108
http://pear.php.net/advisory-20070507.txt
Patch
Vendor Advisory
Exploit
http://pear.php.net/news/vulnerability2.php
http://www.mandriva.com/security/advisories?name=MDKSA-2007:110
http://www.securityfocus.com/bid/24111
http://www.vupen.com/english/advisories/2007/1926
https://exchange.xforce.ibmcloud.com/vulnerabilities/34482