First published: Sun Dec 11 2005(Updated: )
Unspecified vulnerability in PEAR installer 1.4.2 and earlier allows user-assisted attackers to execute arbitrary code via a crafted package that can execute code when the pear command is executed or when the Web/Gtk frontend is loaded.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
PHP PEAR | =0.9 | |
PHP PEAR | =1.3.4 | |
PHP PEAR | =1.2.1 | |
PHP PEAR | =1.3.3.1 | |
PHP PEAR | =1.0.1 | |
PHP PEAR | =1.0 | |
PHP PEAR | =1.2 | |
PHP PEAR | =1.3 | |
PHP PEAR | =0.90 | |
PHP PEAR | =1.4.0-rc2 | |
PHP PEAR | =1.4.1 | |
PHP PEAR | =1.3.5 | |
PHP PEAR | =1.3.6 | |
PHP PEAR | =1.3.3 | |
PHP PEAR | <=1.4.2 | |
PHP PEAR | =1.3.1 | |
PHP PEAR | =1.4.0-rc1 | |
PHP PEAR | =1.4.0 | |
PHP PEAR | =0.10 | |
PHP PEAR | =0.11 | |
PHP PEAR | =1.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2005-4154 is considered a critical vulnerability due to its potential for arbitrary code execution.
To fix CVE-2005-4154, upgrade your PEAR installation to version 1.4.2 or later.
CVE-2005-4154 affects PEAR versions up to and including 1.4.1.
CVE-2005-4154 is primarily a user-assisted attack, requiring the victim to execute a malicious package.
CVE-2005-4154 could allow attackers to execute arbitrary code on the user's machine when malicious packages are processed.