Security update for php8-pear SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3198-1 Final 1 1 2022-09-08T08:36:07Z current 2022-09-08T08:36:07Z 2022-09-08T08:36:07Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php8-pear This update for php8-pear fixes the following issues: - Add php8-pear to SLE15-SP4 (jsc#SLE-24728) - Update to 1.10.21 - PEAR 1.10.13 * unsupported protocol - use --force to continue * Add $this operator to _determineIfPowerpc calls - Update to 1.10.20 - Archive_Tar 1.4.14 * Properly fix symbolic link path traversal (CVE-2021-32610) - Archive_Tar 1.4.13 * Relative symlinks failing (out-of path file extraction) - Archive_Tar 1.4.12 - Archive_Tar 1.4.11 - Archive_Tar 1.4.10 * Fix block padding when the file buffer length is a multiple of 512 and smaller than Archive_Tar buffer length * Don't try to copy username/groupname in chroot jail - provides and obsoletes php7-pear-Archive_Tar, former location of PEAR/Archive/Tar.php - Update to version 1.10.19 - PEAR 1.10.12 * adjust dependencies based on new releases - XML_Util 1.4.5 * fix Trying to access array offset on value of type int - Update to version 1.10.18 - Remove pear-cacheid-array-check.patch (upstreamed) - Contents of .filemap are now sorted internally - Sort contents of .filemap to make build reproducible - Recommend php7-openssl to allow https sources to be used - Modify metadata_dir for system configuration only - Add /var/lib/pear directory where xml files are stored - Cleanup %files section - Only use the GPG keys of Chuck Burgess. Extracted from the Release Manager public keys. - Add release versions of PEAR modules - Install metadata files (registry, filemap, channels, ...) in /var/lib/pear/ instead of /usr/share/php7/PEAR/ - Update to version 1.10.17 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3198,SUSE-SLE-Module-Web-Scripting-15-SP4-2022-3198 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223198-1/ Link for SUSE-SU-2022:3198-1 https://lists.suse.com/pipermail/sle-security-updates/2022-September/012180.html E-Mail link for SUSE-SU-2022:3198-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2021-32610/ SUSE CVE CVE-2021-32610 page SUSE Linux Enterprise Module for Web and Scripting 15 SP4 php8-pear-1.10.21-150400.9.3.1 php8-pecl-1.10.21-150400.9.3.1 php8-pear-1.10.21-150400.9.3.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP4 php8-pecl-1.10.21-150400.9.3.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP4 In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. CVE-2021-32610 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:php8-pear-1.10.21-150400.9.3.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:php8-pecl-1.10.21-150400.9.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223198-1/ https://www.suse.com/security/cve/CVE-2021-32610.html CVE-2021-32610