The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.
References
Link | Resource |
---|---|
http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html | Mailing List Third Party Advisory |
http://lists.opensuse.org/opensuse-updates/2014-09/msg00055.html | Mailing List Third Party Advisory |
http://www.openwall.com/lists/oss-security/2014/08/27/3 | Mailing List Third Party Advisory |
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html | Third Party Advisory |
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759282 | Exploit Issue Tracking Third Party Advisory |
http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html | Mailing List Third Party Advisory |
http://lists.opensuse.org/opensuse-updates/2014-09/msg00055.html | Mailing List Third Party Advisory |
http://www.openwall.com/lists/oss-security/2014/08/27/3 | Mailing List Third Party Advisory |
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html | Third Party Advisory |
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759282 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
21 Nov 2024, 02:12
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html - Mailing List, Third Party Advisory | |
References | () http://lists.opensuse.org/opensuse-updates/2014-09/msg00055.html - Mailing List, Third Party Advisory | |
References | () http://www.openwall.com/lists/oss-security/2014/08/27/3 - Mailing List, Third Party Advisory | |
References | () http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - Third Party Advisory | |
References | () https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759282 - Exploit, Issue Tracking, Third Party Advisory |
Information
Published : 2014-09-27 10:55
Updated : 2024-11-21 02:12
NVD link : CVE-2014-5459
Mitre link : CVE-2014-5459
CVE.ORG link : CVE-2014-5459
JSON object : View
Products Affected
php
- php
opensuse
- opensuse
- evergreen
oracle
- solaris
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')