CVE-2021-21706
Fixed in a distro release EPSS 1%CVSS 5.3
In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.
Products: PHP Group PHP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Enterprise Storage 7 | php7 | 7.4.33-150200.3.46.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | php7 | 7.4.33-150200.3.46.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | php7 | 7.4.33-150200.3.46.2 |
| SUSE Linux Enterprise Module for Package Hub 15 SP3 | php7 | 7.4.33-150200.3.46.2 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | php74 | 7.4.33-1.47.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP3 | php7 | 7.4.33-150200.3.46.2 |
| SUSE Linux Enterprise Server 15 SP2-BCL | php7 | 7.4.33-150200.3.46.2 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | php7 | 7.4.33-150200.3.46.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | php7 | 7.4.33-150200.3.46.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | php74 | 7.4.33-1.47.2 |
| SUSE Manager Proxy 4.1 | php7 | 7.4.33-150200.3.46.2 |
| SUSE Manager Retail Branch Server 4.1 | php7 | 7.4.33-150200.3.46.2 |
| SUSE Manager Server 4.1 | php7 | 7.4.33-150200.3.46.2 |
| Ubuntu 22.04 LTS | php8.1 | 8.1.0-1 |
| openSUSE Leap 15.3 | php7 | 7.4.33-150200.3.46.2 |
| openSUSE Leap 15.3 | php7-test | 7.4.33-150200.3.46.2 |
| openSUSE Leap 15.4 | php7 | 7.4.33-150200.3.46.2 |
| openSUSE Tumbleweed | php7 | 7.4.24-1.1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 |