CVE-2007-2519

Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.

• php group pear 1.0 • php group pear 1.0.1 • php group pear 1.1 • php group pear 1.2 • php group pear 1.2.1 • php group pear 1.2b1 • php group pear 1.2b2 • php group pear 1.2b3 • php group pear 1.2b4 • php group pear 1.2b5 • php group pear 1.3 • php group pear 1.3.1 • php group pear 1.3.3 • php group pear 1.3.3.1 • php group pear 1.3.4 • php group pear 1.3.5 • php group pear 1.3.6 • php group pear 1.3b1 • php group pear 1.3b2 • php group pear 1.3b3 • php group pear 1.3b5 • php group pear 1.3b6 • php group pear 1.4.0 • php group pear 1.4.0a1 • php group pear 1.4.0a2 • php group pear 1.4.0a3 • php group pear 1.4.0a4 • php group pear 1.4.0a5 • php group pear 1.4.0a6 • php group pear 1.4.0a7 • php group pear 1.4.0a8 • php group pear 1.4.0a9 • php group pear 1.4.0a10 • php group pear 1.4.0a11 • php group pear 1.4.0a12 • php group pear 1.4.0b1 • php group pear 1.4.0b2 • php group pear 1.4.0rc1 • php group pear 1.4.0rc2 • php group pear 1.4.1 • php group pear 1.4.2 • php group pear 1.4.3 • php group pear 1.4.4 • php group pear 1.4.5 • php group pear 1.4.6 • php group pear 1.4.7 • php group pear 1.4.8 • php group pear 1.4.9 • php group pear 1.4.10 • php group pear 1.4.10rc1 • php group pear 1.4.11 • php group pear 1.5.0 • php group pear 1.5.0a1 • php group pear 1.5.0rc1 • php group pear 1.5.0rc2 • php group pear 1.5.0rc3 • php group pear 1.5.1 • php group pear 1.5.2 • php group pear 1.5.3