PatchTheCVEpear vulnerabilities and fixes
Recent CVEs affecting pear, with upgrade or downgrade steps. 8 tracked.
pear has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2011-03-03. Highest priority: CVE-2009-4025 (score 58/100).
- CVE-2011-1144 LOW 3.3 UPGRADE The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack o
- CVE-2011-1072 LOW 3.3 UPGRADE The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the
- CVE-2009-4025 HIGH 10.0 UPGRADE Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package be
- CVE-2009-4024 HIGH 10.0 UPGRADE Argument injection vulnerability in the ping function in Ping.php in the Net_Ping package before 2.4.5 for PEA
- CVE-2009-4023 HIGH 7.5 DOWNGRADE Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php) i
- CVE-2007-2519 MEDIUM 6.8 DOWNGRADE Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attac
- CVE-2006-0144 HIGH 7.5 MITIGATE DOWNGRADE The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to
- CVE-2005-4154 MEDIUM 5.1 UPGRADE Unspecified vulnerability in PEAR installer 1.4.2 and earlier allows user-assisted attackers to execute arbitr
FAQ
How do I fix pear vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pear being exploited right now?
None of the tracked pear CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pear CVE should I patch first?
CVE-2009-4025 currently ranks highest (58/100): Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package be.