UBUNTU-CVE-2019-9675

Dashboard / Vulnerabilities / UBUNTU-CVE-2019-9675

UBUNTU-CVE-2019-9675

Summary:

Details: An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.

References: https://ubuntu.com/security/CVE-2019-9675, http://php.net/ChangeLog-7.php, https://ubuntu.com/security/notices/USN-3922-1, https://ubuntu.com/security/notices/USN-3922-2, https://ubuntu.com/security/notices/USN-3922-3, https://www.cve.org/CVERecord?id=CVE-2019-9675