{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-05-07T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "USN-462-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/usn-462-1"}, {"name": "42108", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/42108"}, {"name": "MDKSA-2007:110", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:110"}, {"name": "24111", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/24111"}, {"name": "ADV-2007-1926", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/1926"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://pear.php.net/advisory-20070507.txt"}, {"name": "pear-installer-file-overwrite(34482)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34482"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://pear.php.net/news/vulnerability2.php"}, {"name": "25372", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/25372"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-2519", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "USN-462-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/usn-462-1"}, {"name": "42108", "refsource": "OSVDB", "url": "http://osvdb.org/42108"}, {"name": "MDKSA-2007:110", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:110"}, {"name": "24111", "refsource": "BID", "url": "http://www.securityfocus.com/bid/24111"}, {"name": "ADV-2007-1926", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/1926"}, {"name": "http://pear.php.net/advisory-20070507.txt", "refsource": "CONFIRM", "url": "http://pear.php.net/advisory-20070507.txt"}, {"name": "pear-installer-file-overwrite(34482)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34482"}, {"name": "http://pear.php.net/news/vulnerability2.php", "refsource": "CONFIRM", "url": "http://pear.php.net/news/vulnerability2.php"}, {"name": "25372", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/25372"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-2519", "datePublished": "2007-05-22T19:00:00", "dateReserved": "2007-05-07T00:00:00", "dateUpdated": "2017-07-28T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php_group:pear:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "AD16518B-EA90-4989-B59A-9E7C9DF3B877", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "0419A76C-2783-41E6-8B9D-984099F42454", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "49ED21D8-425B-4A96-A323-EA19D902571A", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.2:*:*:*:*:*:*:*", "matchCriteriaId": "60B41712-9EB6-45F9-B5A3-F01113BE8006", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "C2C050D0-D118-4538-B334-BA23ADC21569", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.2b1:*:*:*:*:*:*:*", "matchCriteriaId": "5ECCACD0-E734-491A-965F-0DF48B4BA253", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.2b2:*:*:*:*:*:*:*", "matchCriteriaId": "2EB4E3E0-6414-46F9-BBEB-DE93FBFA550D", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.2b3:*:*:*:*:*:*:*", "matchCriteriaId": "28735572-3799-47ED-B8D7-2D7A6562CC8D", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.2b4:*:*:*:*:*:*:*", "matchCriteriaId": "666E73A5-B149-468B-A2C7-DF1705477297", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.2b5:*:*:*:*:*:*:*", "matchCriteriaId": "FCFA477B-5396-4625-828D-FCBBCA8493FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3:*:*:*:*:*:*:*", "matchCriteriaId": "C6C105BB-1F21-44B6-AE8C-7C33E75CF648", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "375954D3-275B-4120-B833-2A83091013C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "DBC5456B-C8D4-41EF-9944-1ACE6D04FB16", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "64AE9C03-E7E5-4155-815A-70C160E97F56", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "F3A56EB4-5F2A-4FF9-890A-CA316DE637A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "7EB4E0C4-D8F6-4C6D-9574-09DBE3C2D68D", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "497E6138-C746-44D9-BE46-5713A3AAFD41", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3b1:*:*:*:*:*:*:*", "matchCriteriaId": "2C38F7A3-640C-4383-8707-7D8155CBABAA", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3b2:*:*:*:*:*:*:*", "matchCriteriaId": "5B260EFD-C61A-4DFE-B666-8BE84239A692", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3b3:*:*:*:*:*:*:*", "matchCriteriaId": "BA6161A6-E29C-49AF-A4F5-87934C4EEE84", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3b5:*:*:*:*:*:*:*", "matchCriteriaId": "FC1724F9-8A5B-4126-BABC-22E8603C571A", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.3b6:*:*:*:*:*:*:*", "matchCriteriaId": "6F7D4EDD-5417-42CE-8E30-59499A34BFCB", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "BD19B334-3D0C-4008-A5B5-53FE375B4979", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a1:*:*:*:*:*:*:*", "matchCriteriaId": "C9BDB709-3887-454D-B874-AFD5FD620731", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a2:*:*:*:*:*:*:*", "matchCriteriaId": "B228EA68-3CEE-4880-B060-B333F68794F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a3:*:*:*:*:*:*:*", "matchCriteriaId": "33C10AF9-19B7-4C9F-A489-8C8505D87D49", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a4:*:*:*:*:*:*:*", "matchCriteriaId": "87475278-5B8B-4BE2-9167-46734A435B49", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a5:*:*:*:*:*:*:*", "matchCriteriaId": "207BBE32-3570-4A02-A743-A3A45C2A28DD", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a6:*:*:*:*:*:*:*", "matchCriteriaId": "13D06662-08E6-46D8-A05B-9118D795F203", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a7:*:*:*:*:*:*:*", "matchCriteriaId": "6B6D259D-7AC3-4F4A-A855-64FD8FF7E818", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a8:*:*:*:*:*:*:*", "matchCriteriaId": "2C4B6FDA-0165-4268-95BA-915918099733", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a9:*:*:*:*:*:*:*", "matchCriteriaId": "B506B9CE-CE74-410D-BEFE-75BDF738872A", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a10:*:*:*:*:*:*:*", "matchCriteriaId": "D96FCB3D-AC46-43D7-A2E7-CB6BFED37167", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a11:*:*:*:*:*:*:*", "matchCriteriaId": "D65E8898-C249-401A-97D4-B4431EC04B00", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0a12:*:*:*:*:*:*:*", "matchCriteriaId": "1299C8A2-FB8D-446E-83AC-C78091D14ACF", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0b1:*:*:*:*:*:*:*", "matchCriteriaId": "7BFDED6F-D871-4F81-9ADE-D1B6E5A82E61", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0b2:*:*:*:*:*:*:*", "matchCriteriaId": "AF54A7BC-D8EC-4ABC-9552-25BB4D592A93", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0rc1:*:*:*:*:*:*:*", "matchCriteriaId": "516F5E30-AB29-4AEA-B069-8FEBAF288F46", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.0rc2:*:*:*:*:*:*:*", "matchCriteriaId": "0DBDD00D-0D9C-487B-90A0-D61BAB782C88", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "730B3D7E-43AD-4EA6-A3E7-C0424BA61A64", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "AEFECD3A-4669-4D0C-BC51-AA2B635CB3B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "D1DF4DAD-7129-493B-B7EA-ADA33F734DB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "13766879-04DA-42A2-B147-31D69430FE19", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.5:*:*:*:*:*:*:*", "matchCriteriaId": "F9ADB86D-0655-4289-8644-4DBF76162CA3", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.6:*:*:*:*:*:*:*", "matchCriteriaId": "AA5C847B-FD77-4CB3-BD64-0BDA3EC17A5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.7:*:*:*:*:*:*:*", "matchCriteriaId": "7BE65B11-B3F2-4CB1-994B-979EA3885B21", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.8:*:*:*:*:*:*:*", "matchCriteriaId": "BBCE5B14-6A83-44EA-971E-0CEDBBE6203B", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.9:*:*:*:*:*:*:*", "matchCriteriaId": "3C9A0E25-9DCB-4ABB-8039-D9261A95CA5F", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.10:*:*:*:*:*:*:*", "matchCriteriaId": "84069051-338F-4174-9AEB-C41112B2FFF1", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.10rc1:*:*:*:*:*:*:*", "matchCriteriaId": "3401D8C6-5C42-4F59-AA40-7C5D83551E08", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.4.11:*:*:*:*:*:*:*", "matchCriteriaId": "7E52E2FA-3A8E-40EF-B57E-ADE9AA9810F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "36CEB135-9EFD-490E-BEBA-F3FA75098463", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.5.0a1:*:*:*:*:*:*:*", "matchCriteriaId": "05F60E95-5D51-4D06-B4D4-777E78F89D9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.5.0rc1:*:*:*:*:*:*:*", "matchCriteriaId": "7BB25D31-BD14-4BAB-8D5C-D297F2C61600", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.5.0rc2:*:*:*:*:*:*:*", "matchCriteriaId": "5AEF216F-0ED7-4999-A3A3-285440374773", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.5.0rc3:*:*:*:*:*:*:*", "matchCriteriaId": "B2FF8942-4C67-4674-8DE4-F4948C8FD61D", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "03F711A9-EFD7-46A2-B826-19183FBB3FFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "E8B3F0C6-386E-44B7-85A8-54CE26874384", "vulnerable": true}, {"criteria": "cpe:2.3:a:php_group:pear:1.5.3:*:*:*:*:*:*:*", "matchCriteriaId": "FCDED4C0-5733-4322-844D-A2085AFD6CA6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en el instalador en PEAR 1.0 hasat 1.5.3 permite a atacantes remotos con la intervenci\u00f3n del usuario sobrescribir archivos de su elecci\u00f3n mediante una secuencia .. (punto punto) en (1) el atributo install-as en el elemento fichero (file) en package.xml 1.0 o (2) el atributo as en el elemento instaci\u00f3n (install) en package.xml 2.0. NOTA: podr\u00eda argumentarse que esto no cruza los l\u00edmites de privilegios en instalaciones t\u00edpicas, puesto que el c\u00f3digo que est\u00e1 siendo instalado podr\u00eda realizar las mismas acciones."}], "id": "CVE-2007-2519", "lastModified": "2017-07-29T01:31:31.300", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-05-22T19:30:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/42108"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "http://pear.php.net/advisory-20070507.txt"}, {"source": "cve@mitre.org", "url": "http://pear.php.net/news/vulnerability2.php"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/25372"}, {"source": "cve@mitre.org", "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:110"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/24111"}, {"source": "cve@mitre.org", "url": "http://www.ubuntu.com/usn/usn-462-1"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/1926"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34482"}], "sourceIdentifier": "cve@mitre.org", "vendorComments": [{"comment": "Installation of a PEAR package from an untrusted source could allow malicious code to be installed and potentially executed by the root user. This is true regardless of the existence of this particular bug in the PEAR installer, so the bug would not be treated as security-sensitive. As when handling system RPM packages, the root user must always ensure that any packages installed are from a trusted source and have been packaged correctly.", "lastModified": "2007-05-24T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}