CVE-2011-1144 in PEAR
Summary
The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1072.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
03/02/2011
Disclosure
03/02/2011
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 56700 | PEAR Installer link following | 59 | Not defined | Not defined | CVE-2011-1144 |