CVE

Id
25876  
CVE No.
CVE-2007-2519  
Status
Candidate  
Description
Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.  
Phase
Assigned (20070507)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
259802 25876 CVE-2007-2519 CONFIRM:http://pear.php.net/advisory-20070507.txt  View
259803 25876 CVE-2007-2519 CONFIRM:http://pear.php.net/news/vulnerability2.php  View
259804 25876 CVE-2007-2519 MANDRIVA:MDKSA-2007:110  View
259805 25876 CVE-2007-2519 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:110  View
259806 25876 CVE-2007-2519 UBUNTU:USN-462-1  View
259807 25876 CVE-2007-2519 URL:http://www.ubuntu.com/usn/usn-462-1  View
259808 25876 CVE-2007-2519 BID:24111  View
259809 25876 CVE-2007-2519 URL:http://www.securityfocus.com/bid/24111  View
259810 25876 CVE-2007-2519 VUPEN:ADV-2007-1926  View
259811 25876 CVE-2007-2519 URL:http://www.vupen.com/english/advisories/2007/1926  View
259812 25876 CVE-2007-2519 OSVDB:42108  View
259813 25876 CVE-2007-2519 URL:http://osvdb.org/42108  View
259814 25876 CVE-2007-2519 SECUNIA:25372  View
259815 25876 CVE-2007-2519 URL:http://secunia.com/advisories/25372  View
259816 25876 CVE-2007-2519 XF:pear-installer-file-overwrite(34482)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
53285 JVNDB-2007-001977 E-GADS! の common.php における PHP リモートファイルインクルージョンの脆弱性 E-GADS! の common.php は、PHP リモートファイルインクルージョンの脆弱性が存在します。 CVE-2007-2521 25876 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001977.html  View