CVE-2018-1000888 – PEAR Archive_Tar < 1.4.4 - PHP Object Injection

https://notcve.org/view.php?id=CVE-2018-1000888

27 Dec 2018 — PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the Archive_Tar class itself. With Ar... • https://packetstorm.news/files/id/151094 • CWE-502: Deserialization of Untrusted Data •