Archive Tar (Php) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 20 known versions, newest CVE from 2024-04-29. Vendor: Php.

CVEs of Archive Tar

• CVE-2024-2756 - CVSS 6.5 (medium), 2024-04-29: Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure…
• CVE-2021-32610 - CVSS 7.1 (high), 2021-07-30: In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
• CVE-2020-36193 - CVSS 7.5 (high), 2021-01-18: Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to…
• CVE-2020-28948 - CVSS 7.8 (high), 2020-11-19: Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
• CVE-2020-28949 - CVSS 7.8 (high), 2020-11-19: Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite…