p PatchFirst

CVE-2017-5630

CVE-2017-5630

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.

CVSS 7.5 · High · EPSS 12.5% · Public exploit

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • php-pear Debian:12

    Versions
    • 1:1.10.13+submodules+notgz+2022032202-2
    • 1:1.10.16+submodules+notgz-1
    • 1:1.10.16+submodules+notgz-2
    • 1:1.10.16+submodules+notgz-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Debian:13

    Versions
    • 1:1.10.16+submodules+notgz-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Debian:14

    Versions
    • 1:1.10.16+submodules+notgz-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pear/pear Packagist

    Affected ranges
    • ECOSYSTEM: ≤ 1.10.1

    No fix published

  • php5 Ubuntu:Pro:14.04:LTS

    Versions
    • 5.5.3+dfsg-1ubuntu2
    • 5.5.3+dfsg-1ubuntu3
    • 5.5.6+dfsg-1ubuntu1
    • 5.5.6+dfsg-1ubuntu2
    • 5.5.8+dfsg-2ubuntu1
    • 5.5.9+dfsg-1ubuntu1
    • 5.5.9+dfsg-1ubuntu2
    • 5.5.9+dfsg-1ubuntu3
    • 5.5.9+dfsg-1ubuntu4
    • 5.5.9+dfsg-1ubuntu4.1
    • 5.5.9+dfsg-1ubuntu4.2
    • 5.5.9+dfsg-1ubuntu4.3
    • 5.5.9+dfsg-1ubuntu4.4
    • 5.5.9+dfsg-1ubuntu4.5
    • 5.5.9+dfsg-1ubuntu4.6
    • 5.5.9+dfsg-1ubuntu4.7
    • 5.5.9+dfsg-1ubuntu4.9
    • 5.5.9+dfsg-1ubuntu4.11
    • 5.5.9+dfsg-1ubuntu4.12
    • 5.5.9+dfsg-1ubuntu4.13
    • 5.5.9+dfsg-1ubuntu4.14
    • 5.5.9+dfsg-1ubuntu4.16
    • 5.5.9+dfsg-1ubuntu4.17
    • 5.5.9+dfsg-1ubuntu4.19
    • 5.5.9+dfsg-1ubuntu4.20
    • 5.5.9+dfsg-1ubuntu4.21
    • 5.5.9+dfsg-1ubuntu4.22
    • 5.5.9+dfsg-1ubuntu4.23
    • 5.5.9+dfsg-1ubuntu4.24
    • 5.5.9+dfsg-1ubuntu4.25
    • 5.5.9+dfsg-1ubuntu4.26
    • 5.5.9+dfsg-1ubuntu4.27
    • 5.5.9+dfsg-1ubuntu4.29
    • 5.5.9+dfsg-1ubuntu4.29+esm1
    • 5.5.9+dfsg-1ubuntu4.29+esm2
    • 5.5.9+dfsg-1ubuntu4.29+esm3
    • 5.5.9+dfsg-1ubuntu4.29+esm4
    • 5.5.9+dfsg-1ubuntu4.29+esm5
    • 5.5.9+dfsg-1ubuntu4.29+esm6
    • 5.5.9+dfsg-1ubuntu4.29+esm8
    • 5.5.9+dfsg-1ubuntu4.29+esm10
    • 5.5.9+dfsg-1ubuntu4.29+esm11
    • 5.5.9+dfsg-1ubuntu4.29+esm12
    • 5.5.9+dfsg-1ubuntu4.29+esm13
    • 5.5.9+dfsg-1ubuntu4.29+esm14
    • 5.5.9+dfsg-1ubuntu4.29+esm15
    • 5.5.9+dfsg-1ubuntu4.29+esm16
    • 5.5.9+dfsg-1ubuntu4.29+esm17
    • 5.5.9+dfsg-1ubuntu4.29+esm18
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Ubuntu:Pro:16.04:LTS

    Versions
    • 1:1.10.1+submodules+notgz-4
    • 1:1.10.1+submodules+notgz-6
    • 1:1.10.1+submodules+notgz-6ubuntu0.1
    • 1:1.10.1+submodules+notgz-6ubuntu0.2
    • 1:1.10.1+submodules+notgz-6ubuntu0.3
    • 1:1.10.1+submodules+notgz-6ubuntu0.3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Ubuntu:18.04:LTS

    Versions
    • 1:1.10.5+submodules+notgz-1
    • 1:1.10.5+submodules+notgz-1ubuntu1
    • 1:1.10.5+submodules+notgz-1ubuntu1.18.04.1
    • 1:1.10.5+submodules+notgz-1ubuntu1.18.04.2
    • 1:1.10.5+submodules+notgz-1ubuntu1.18.04.3
    • 1:1.10.5+submodules+notgz-1ubuntu1.18.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Ubuntu:20.04:LTS

    Versions
    • 1:1.10.9+submodules+notgz-1
    • 1:1.10.9+submodules+notgz-1ubuntu0.20.04.1
    • 1:1.10.9+submodules+notgz-1ubuntu0.20.04.2
    • 1:1.10.9+submodules+notgz-1ubuntu0.20.04.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Ubuntu:22.04:LTS

    Versions
    • 1:1.10.12+submodules+notgz+20210212-1ubuntu1
    • 1:1.10.12+submodules+notgz+20210212-1ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Ubuntu:24.04:LTS

    Versions
    • 1:1.10.13+submodules+notgz+2022032202-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Ubuntu:25.10

    Versions
    • 1:1.10.13+submodules+notgz+2022032202-2build1
    • 1:1.10.16+submodules+notgz-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Ubuntu:26.10

    Versions
    • 1:1.10.16+submodules+notgz-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-pear Ubuntu:26.04:LTS

    Versions
    • 1:1.10.16+submodules+notgz-3
    • 1:1.10.16+submodules+notgz-3build1
    • 1:1.10.16+submodules+notgz-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →