CVE-2019-9675

    Dashboard / Vulnerabilities / CVE-2019-9675

    CVE-2019-9675

    Published: 11 Mar 2019Last Modified: 7 Aug 2026

    Summary:

    Details: An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.

    References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html, http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html, http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html, http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html, http://php.net/ChangeLog-7.php, https://usn.ubuntu.com/3922-2/, https://usn.ubuntu.com/3922-3/, https://bugs.php.net/bug.php?id=77586

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 60fffd296abce5fc071f3c173c25a2696cf683c6
    Fixed -2e280a77845f3ca94ef19a1872106c52ad1cf4e3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2019-9675 | CVE-DB