Most recent entries from all

ALSA-2022:6542 — Moderate: php:7.4 security update

Affected: AlmaLinux:8: apcu-panel, AlmaLinux:8: libzip, AlmaLinux:8: libzip-devel, AlmaLinux:8: libzip-tools, AlmaLinux:8: php, AlmaLinux:8: php-bcmath, AlmaLinux:8: php-cli, AlmaLinux:8: php-common, AlmaLinux:8: php-dba, AlmaLinux:8: php-dbg and 27 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked (CVE-2020-28948) * Archive_Tar: improper filename sanitization leads to file overwrites (CVE-2020-28949) * Archive_Tar: directory traversal due to inadequate checking of symbolic links (CVE-2020-36193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-03618

BIT-drupal-2020-28949

Affected: Bitnami: drupal

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

certfr-2020-avi-777 — De multiples vulnérabilités ont été découvertes dans Drupal core. Elles permettent à un attaquant de provoquer une atte…

certfr-2020-avi-777

CLEANSTART-2024-ZN01309 — Archive_Tar through 1

Affected: CleanStart: drupal7

Security vulnerability affects the drupal7 package. Archive_Tar through 1.

EUVD-2026-256050

fkie_cve-2020-28949

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

FSA-202302 — Festo: Several vulnerabilities in FactoryViews

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

GHSA-75c5-f4gw-38r9 — Multiple vulnerabilities through filename manipulation in Archive_Tar

Affected: Packagist: pear/archive_tar

Archive_Tar through 1.4.10 has `://` filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as `file://` to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33

gsd-2020-28949

RHSA-2022:6541 — Red Hat Security Advisory: php:7.4 security update

Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked Archive_Tar: improper filename sanitization leads to file overwrites Archive_Tar: directory traversal due to inadequate checking of symbolic links

RHSA-2022:6542 — Red Hat Security Advisory: php:7.4 security update

UBUNTU-CVE-2020-28949

Affected: Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:16.04:LTS: php-pear, Ubuntu:Pro:16.04:LTS: drupal7, Ubuntu:18.04:LTS: php-pear, Ubuntu:20.04:LTS: php-pear

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

WID-SEC-W-2022-1443 — Drupal: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes

Ein lokaler Angreifer kann eine Schwachstelle in Drupal ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.