CVE-2019-6338
Fixed in a distro release EPSS 2%
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details
Products: Drupal Core
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | drupal/core | 8.5.9 |
| Packagist | drupal/core | 8.6.6 |
| Packagist | drupal/drupal | 7.62.0 |
| Packagist | drupal/drupal | 8.5.9 |
| Packagist | drupal/drupal | 8.6.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 8 | drupal7 | 7.32-1+deb8u15 |
| Debian 9 | drupal7 | 7.52-2+deb9u6 |
| Ubuntu Pro 14.04 LTS | drupal7 | no fix |
| Ubuntu Pro 16.04 LTS | drupal7 | no fix |