Ubuntu 20.04 LTS: USN-4723-2 Severe Vulnerability in Remote Code Execution

ubuntu

February 8, 2021

PEAR could be made to overwrite files as the administrator.

Summary

PEAR could be made to overwrite files as the administrator.

Software Description:

- php-pear: PHP Extension and Application Repository

Details:

It was discovered that PEAR incorrectly handled symbolic links in archives.

A remote attacker could possibly use this issue to execute arbitrary code.

Topics Covered

security advisory critical remote code execution file overwrite php-pear ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  php-pear                        1:1.10.9+submodules+notgz-1ubuntu0.20.10.2

Ubuntu 20.04 LTS:
  php-pear                        1:1.10.9+submodules+notgz-1ubuntu0.20.04.2

Ubuntu 18.04 LTS:
  php-pear                        1:1.10.5+submodules+notgz-1ubuntu1.18.04.3

Ubuntu 16.04 LTS:
  php-pear                        1:1.10.1+submodules+notgz-6ubuntu0.3

In general, a standard system update will make all the necessary changes.