CVE-2007-2519

Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.

Link	Resource
http://pear.php.net/advisory-20070507.txt	Exploit Patch
http://pear.php.net/news/vulnerability2.php
http://www.mandriva.com/security/advisories?name=MDKSA-2007:110
http://www.ubuntu.com/usn/usn-462-1
http://www.securityfocus.com/bid/24111
http://secunia.com/advisories/25372
http://osvdb.org/42108
http://www.vupen.com/english/advisories/2007/1926
https://exchange.xforce.ibmcloud.com/vulnerabilities/34482

Configuration 1

cpe:2.3:a:php_group:pear:1.4.0a4:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3b5:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.2b2:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a10:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.3:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3b6:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3b3:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a6:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0rc2:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3.3:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.5.0a1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.11:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.5.2:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a5:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.2b4:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a12:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a2:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.5.3:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3.4:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0b1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3.5:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.5.1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.8:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3b2:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.2b3:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.0:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3.6:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3.1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a8:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a3:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0rc1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3.3.1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.5.0rc2:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.5:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.2b1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.2:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.2:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.5.0rc3:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a9:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.5.0:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.2b5:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0b2:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a11:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.10rc1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.7:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0a7:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.0:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.10:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.5.0rc1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.4:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.3b1:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.6:*:*:*:*:*:*:* cpe:2.3:a:php_group:pear:1.4.9:*:*:*:*:*:*:*

---

Published : 2007-05-22 07:30

Updated : 2017-07-29 01:31

---

NVD link : CVE-2007-2519

Mitre link : CVE-2007-2519

No products.

NVD-CWE-Other