p PatchFirst

CVE-2019-6338

CVE-2019-6338 · third-party PEAR Archive_Tar library updates

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

CVSS 8.0 · High · EPSS 2.1% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • drupal core

    Versions
    • ≥ 7.x, < 7.62: Affected (custom)
    • ≥ 8.6.x, < 8.6.6.: Affected (custom)
    • ≥ 8.5.x, < 8.5.9: Affected (custom)

    Update to 7.62; Update to 8.5.9; Update to 8.6.6.

  • drupal/core Packagist

    Versions
    • 8.0.0
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.0.4
    • 8.0.5
    • 8.0.6
    • 8.1.0
    • 8.1.0-beta1
    • 8.1.0-beta2
    • 8.1.0-rc1
    • 8.1.1
    • 8.1.10
    • 8.1.2
    • 8.1.3
    • 8.1.4
    • 8.1.5
    • 8.1.6
    • 8.1.7
    • 8.1.8
    • 8.1.9
    • 8.2.0
    • 8.2.0-beta1
    • 8.2.0-beta2
    • 8.2.0-beta3
    • 8.2.0-rc1
    • 8.2.0-rc2
    • 8.2.1
    • 8.2.2
    • 8.2.3
    • 8.2.4
    • 8.2.5
    • 8.2.6
    • 8.2.7
    • 8.2.8
    • 8.3.0
    • 8.3.0-alpha1
    • 8.3.0-beta1
    • 8.3.0-rc1
    • 8.3.0-rc2
    • 8.3.1
    • 8.3.2
    • 8.3.3
    • 8.3.4
    • 8.3.5
    • 8.3.6
    • 8.3.7
    • 8.3.8
    • 8.3.9
    • 8.4.0
    • 8.4.0-alpha1
    • 8.4.0-beta1
    • 8.4.0-rc1
    • 8.4.0-rc2
    • 8.4.1
    • 8.4.2
    • 8.4.3
    • 8.4.4
    • 8.4.5
    • 8.4.6
    • 8.4.7
    • 8.4.8
    • 8.5.0
    • 8.5.0-alpha1
    • 8.5.0-beta1
    • 8.5.0-rc1
    • 8.5.1
    • 8.5.2
    • 8.5.3
    • 8.5.4
    • 8.5.5
    • 8.5.6
    • 8.5.7
    • 8.5.8
    • 8.6.0
    • 8.6.1
    • 8.6.2
    • 8.6.3
    • 8.6.4
    • 8.6.5
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.5.9
    • ECOSYSTEM: ≥ 8.6.0, < 8.6.6

    Update to 8.5.9; Update to 8.6.6

  • drupal/drupal Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 7.0.0, < 7.62.0

    Update to 7.62.0

  • drupal/drupal Packagist

    Versions
    • 8.0.0
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.0.4
    • 8.0.5
    • 8.0.6
    • 8.1.0
    • 8.1.0-beta1
    • 8.1.0-beta2
    • 8.1.0-rc1
    • 8.1.1
    • 8.1.10
    • 8.1.2
    • 8.1.3
    • 8.1.4
    • 8.1.5
    • 8.1.6
    • 8.1.7
    • 8.1.8
    • 8.1.9
    • 8.2.0
    • 8.2.0-beta1
    • 8.2.0-beta2
    • 8.2.0-beta3
    • 8.2.0-rc1
    • 8.2.0-rc2
    • 8.2.1
    • 8.2.2
    • 8.2.3
    • 8.2.4
    • 8.2.5
    • 8.2.6
    • 8.2.7
    • 8.2.8
    • 8.3.0
    • 8.3.0-alpha1
    • 8.3.0-beta1
    • 8.3.0-rc1
    • 8.3.0-rc2
    • 8.3.1
    • 8.3.2
    • 8.3.3
    • 8.3.4
    • 8.3.5
    • 8.3.6
    • 8.3.7
    • 8.3.8
    • 8.3.9
    • 8.4.0
    • 8.4.0-alpha1
    • 8.4.0-beta1
    • 8.4.0-rc1
    • 8.4.0-rc2
    • 8.4.1
    • 8.4.2
    • 8.4.3
    • 8.4.4
    • 8.4.5
    • 8.4.6
    • 8.4.7
    • 8.4.8
    • 8.5.0
    • 8.5.0-alpha1
    • 8.5.0-beta1
    • 8.5.0-rc1
    • 8.5.1
    • 8.5.2
    • 8.5.3
    • 8.5.4
    • 8.5.5
    • 8.5.6
    • 8.5.7
    • 8.5.8
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.5.9

    Update to 8.5.9

  • drupal/drupal Packagist

    Versions
    • 8.6.0
    • 8.6.1
    • 8.6.2
    • 8.6.3
    • 8.6.4
    • 8.6.5
    Affected ranges
    • ECOSYSTEM: ≥ 8.6.0, < 8.6.6

    Update to 8.6.6

  • drupal7 Ubuntu:Pro:14.04:LTS

    Versions
    • 7.23-1
    • 7.24-1
    • 7.24-2
    • 7.26-1
    • 7.26-1ubuntu0.1
    • 7.26-1ubuntu0.1+esm1
    • 7.26-1ubuntu0.1+esm2
    • 7.26-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • drupal7 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.38-1
    • 7.41-1
    • 7.44-1ubuntu1~16.04.0
    • 7.44-1ubuntu1~16.04.0+esm1
    • 7.44-1ubuntu1~16.04.0+esm2
    • 7.44-1ubuntu1~16.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →