CVE-2014-5459
Fixed in a distro release EPSS <1%
The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.
Products: php, oracle solaris, opensuse evergreen, opensuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Server 11 SP2-LTSS | php53 | 5.3.17-47.1 |
| Ubuntu 18.04 LTS | php-pear | no fix |
| Ubuntu 20.04 LTS | php-pear | no fix |
| Ubuntu 22.04 LTS | php-pear | no fix |
| Ubuntu 24.04 LTS | php-pear | no fix |
| Ubuntu 25.10 | php-pear | no fix |
| Ubuntu 26.04 LTS | php-pear | no fix |
| Ubuntu 26.10 | php-pear | no fix |
| Ubuntu Pro 14.04 LTS | php5 | no fix |
| Ubuntu Pro 16.04 LTS | php-pear | no fix |
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 |