Ubuntu 20.10: USN-4655-1 Critical: PHP Session Token Vulnerability

ubuntu

December 1, 2020

PEAR could be made to run programs as an administrator.

Summary

PEAR could be made to run programs as an administrator.

Software Description:

- php-pear: PHP Extension and Application Repository

Details:

It was discovered that PEAR incorrectly sanitized filenames. A remote

attacker could possibly use this issue to execute arbitrary code.

Topics Covered

security advisory moderate remote code execution php-pear ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  php-pear                        1:1.10.9+submodules+notgz-1ubuntu0.20.10.1

Ubuntu 20.04 LTS:
  php-pear                        1:1.10.9+submodules+notgz-1ubuntu0.20.04.1

Ubuntu 18.04 LTS:
  php-pear                        1:1.10.5+submodules+notgz-1ubuntu1.18.04.2

Ubuntu 16.04 LTS:
  php-pear                        1:1.10.1+submodules+notgz-6ubuntu0.2

In general, a standard system update will make all the necessary changes.