CVEvulnerability
CVE-2014-5459
3.6 LOW
Official page ↗
- Status
- Modified
- Published
- 2014-09-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.6 LOW — AV:L/AC:L/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-59
Description
The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.
Affected configurations
• php php (<= 5.6.0)
• oracle solaris 11.2
• opensuse evergreen 11.4
• opensuse opensuse 12.3
• opensuse opensuse 13.1
Related
Weakness · CWE (1)
- CWE-59 Improper Link Resolution Before File Access weakness
References
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00055.html Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/08/27/3 Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759282 Exploit, Issue Tracking, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00055.html Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/08/27/3 Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759282 Exploit, Issue Tracking, Third Party Advisory