Read the docs
TI-2011-00925 Aliases CVE-2011-1072GHSA-pm7p-73v9-hmx9

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a…

Priority LOW 17CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories, a different vulnerability than CVE-2007-2519.

Why it matters now

EPSS 0.00477 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:php:pear:*:*:*:*:*:*:*:*up to 1.9.1VulnerablePHP
cpe:2.3:a:php:pear:0.2.2:*:*:*:*:*:*:*0.2.2VulnerablePHP
cpe:2.3:a:php:pear:0.9:*:*:*:*:*:*:*0.9VulnerablePHP
cpe:2.3:a:php:pear:0.10:*:*:*:*:*:*:*0.10VulnerablePHP
cpe:2.3:a:php:pear:0.11:*:*:*:*:*:*:*0.11VulnerablePHP
cpe:2.3:a:php:pear:0.90:*:*:*:*:*:*:*0.90VulnerablePHP
cpe:2.3:a:php:pear:1.0:*:*:*:*:*:*:*1.0VulnerablePHP
cpe:2.3:a:php:pear:1.0.1:*:*:*:*:*:*:*1.0.1VulnerablePHP
cpe:2.3:a:php:pear:1.1:*:*:*:*:*:*:*1.1VulnerablePHP
cpe:2.3:a:php:pear:1.2:*:*:*:*:*:*:*1.2VulnerablePHP
  • cpe:2.3:a:php:pear:*:*:*:*:*:*:*:* Versions up to 1.9.1 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:0.2.2:*:*:*:*:*:*:* Versions 0.2.2 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:0.10:*:*:*:*:*:*:* Versions 0.10 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:0.11:*:*:*:*:*:*:* Versions 0.11 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:0.90:*:*:*:*:*:*:* Versions 0.90 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·PHP
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:php:pear:1.2.1:*:*:*:*:*:*:*1.2.1VulnerablePHP
cpe:2.3:a:php:pear:1.3:*:*:*:*:*:*:*1.3VulnerablePHP
cpe:2.3:a:php:pear:1.3.1:*:*:*:*:*:*:*1.3.1VulnerablePHP
cpe:2.3:a:php:pear:1.3.3:*:*:*:*:*:*:*1.3.3VulnerablePHP
cpe:2.3:a:php:pear:1.3.3.1:*:*:*:*:*:*:*1.3.3.1VulnerablePHP
cpe:2.3:a:php:pear:1.3.4:*:*:*:*:*:*:*1.3.4VulnerablePHP
cpe:2.3:a:php:pear:1.3.5:*:*:*:*:*:*:*1.3.5VulnerablePHP
cpe:2.3:a:php:pear:1.3.6:*:*:*:*:*:*:*1.3.6VulnerablePHP
cpe:2.3:a:php:pear:1.4.0:*:*:*:*:*:*:*1.4.0VulnerablePHP
cpe:2.3:a:php:pear:1.4.0:rc1:*:*:*:*:*:*1.4.0 rc1VulnerablePHP
cpe:2.3:a:php:pear:1.4.0:rc2:*:*:*:*:*:*1.4.0 rc2VulnerablePHP
cpe:2.3:a:php:pear:1.4.1:*:*:*:*:*:*:*1.4.1VulnerablePHP
cpe:2.3:a:php:pear:1.4.2:*:*:*:*:*:*:*1.4.2VulnerablePHP
cpe:2.3:a:php:pear:1.5.0:*:*:*:*:*:*:*1.5.0VulnerablePHP
cpe:2.3:a:php:pear:1.5.1:*:*:*:*:*:*:*1.5.1VulnerablePHP
cpe:2.3:a:php:pear:1.6.1:*:*:*:*:*:*:*1.6.1VulnerablePHP
  • cpe:2.3:a:php:pear:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.3.3.1:*:*:*:*:*:*:* Versions 1.3.3.1 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.4.0:rc1:*:*:*:*:*:* Versions 1.4.0 rc1 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.4.0:rc2:*:*:*:*:*:* Versions 1.4.0 rc2 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·PHP
  • cpe:2.3:a:php:pear:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·PHP

Remediation

Red Hat 1 advisory

  • RHSA-2011:1741 Released 2011-12-05 · Red Hat rating Low
    php-pear security and bug fix update
    • Red Hat Enterprise Linux Server (v. 6) php-pear-1:1.9.4-4.el6
    • Red Hat Enterprise Linux Workstation (v. 6) php-pear-1:1.9.4-4.el6

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1741
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:1741
Not affected: 1 product
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-1072
  2. 2026-10-03 Alias added: GHSA-pm7p-73v9-hmx9

References

Exploit 1

Patch 2

Advisory 3

Other 10

  • TI-2017-03631 PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not… CVSS 3.1HIGH 7.5
  • TI-2006-00137 The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad… CVSS 2.0HIGH 7.5
  • TI-2005-03909 Unspecified vulnerability in PEAR installer 1.4.2 and earlier allows user-assisted… CVSS 2.0MEDIUM 5.1
  • TI-2011-00997 The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files… CVSS 2.0LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences