Server side cross-site scripting In php5
Description
An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.5 | =5.2.10-r0 || =5.2.10-r2 || =5.2.10-r3 || =5.2.10-r4 || =5.2.11-r0 || =5.2.8-r0 || =5.2.8-r1 || =5.2.9-r0 || =5.3.0-r0 || =5.3.0-r1 || =5.3.0-r2 || =5.3.0-r3 || =5.3.1-r0 || =5.3.1-r1 || =5.3.1-r2 || =5.3.1-r3 || =5.3.1-r4 || =5.3.1-r5 || =5.3.10-r0 || =5.3.10-r1 || =5.3.10-r2 || =5.3.10-r3 || =5.3.10-r4 || =5.3.10-r5 || =5.3.12-r0 || =5.3.12-r1 || =5.3.12-r2 || =5.3.12-r3 || =5.3.15-r3 || =5.3.16-r0 || =5.3.17-r0 || =5.3.18-r0 || =5.3.19-r0 || =5.3.2-r0 || =5.3.2-r1 || =5.3.2-r2 || =5.3.2-r3 || =5.3.2-r4 || =5.3.2-r5 || =5.3.2-r6 || =5.3.2-r7 || =5.3.2-r8 || =5.3.20-r0 || =5.3.20-r1 || =5.3.21-r1 || =5.3.21-r2 || =5.3.23-r0 || =5.3.23-r1 || =5.3.3-r0 || =5.3.3-r1 || =5.3.3-r2 || =5.3.3-r3 || =5.3.3-r4 || =5.3.3-r5 || =5.3.4-r0 || =5.3.4-r1 || =5.3.4-r2 || =5.3.5-r0 || =5.3.5-r1 || =5.3.5-r2 || =5.3.5-r3 || =5.3.5-r4 || =5.3.5-r5 || =5.3.5-r6 || =5.3.5-r7 || =5.3.6-r0 || =5.3.6-r1 || =5.3.6-r10 || =5.3.6-r11 || =5.3.6-r2 || =5.3.6-r3 || =5.3.6-r4 || =5.3.6-r5 || =5.3.6-r6 || =5.3.6-r7 || =5.3.6-r8 || =5.3.6-r9 || =5.3.7-r0 || =5.3.7-r1 || =5.3.8-r0 || =5.3.8-r1 || =5.3.8-r2 || =5.3.9-r0 || =5.3.9-r1 || =5.4.14-r0 || =5.4.14-r1 || =5.4.14-r2 || =5.4.14-r3 || =5.4.15-r0 || =5.4.15-r1 || =5.4.16-r0 || =5.4.17-r0 || =5.4.17-r1 || =5.4.19-r0 || =5.4.20-r0 || =5.5.10-r0 || =5.5.11-r0 || =5.5.11-r1 || =5.5.12-r0 || =5.5.13-r0 || =5.5.13-r1 || =5.5.13-r2 || =5.5.13-r3 || =5.5.13-r4 || =5.5.14-r0 || =5.5.15-r0 || =5.5.15-r1 || =5.5.16-r0 || =5.5.4-r0 || =5.5.4-r1 || =5.5.5-r0 || =5.5.5-r1 || =5.5.5-r2 || =5.5.6-r0 || =5.5.6-r1 || =5.5.7-r0 || =5.5.8-r0 || =5.5.8-r1 || =5.5.9-r0 || =5.6.1-r0 || =5.6.1-r1 || =5.6.1-r2 || =5.6.10-r0 || =5.6.11-r0 || =5.6.12-r0 || =5.6.13-r0 || =5.6.14-r0 || =5.6.15-r0 || =5.6.15-r1 || =5.6.15-r2 || =5.6.15-r3 || =5.6.16-r0 || =5.6.17-r0 || =5.6.18-r0 || =5.6.18-r1 || =5.6.19-r0 || =5.6.19-r1 || =5.6.2-r0 || =5.6.2-r1 || =5.6.20-r0 || =5.6.21-r0 || =5.6.21-r1 || =5.6.21-r2 || =5.6.22-r0 || =5.6.23-r0 || =5.6.24-r0 || =5.6.25-r0 || =5.6.25-r1 || =5.6.26-r0 || =5.6.26-r1 || =5.6.27-r0 || =5.6.28-r0 || =5.6.29-r0 || =5.6.29-r1 || =5.6.3-r0 || =5.6.30-r0 || =5.6.31-r0 || =5.6.32-r0 || =5.6.33-r0 || =5.6.34-r0 || =5.6.35-r0 || =5.6.4-r0 || =5.6.5-r0 || =5.6.5-r1 || =5.6.6-r0 || =5.6.7-r0 || =5.6.7-r1 || =5.6.8-r0 || =5.6.8-r1 || =5.6.9-r0 || =5.6.9-r1 || >=0 <5.6.36-r0 | 5.6.36-r0 | |
alpine v3.4 | =5.2.10-r0 || =5.2.10-r2 || =5.2.10-r3 || =5.2.10-r4 || =5.2.11-r0 || =5.2.8-r0 || =5.2.8-r1 || =5.2.9-r0 || =5.3.0-r0 || =5.3.0-r1 || =5.3.0-r2 || =5.3.0-r3 || =5.3.1-r0 || =5.3.1-r1 || =5.3.1-r2 || =5.3.1-r3 || =5.3.1-r4 || =5.3.1-r5 || =5.3.10-r0 || =5.3.10-r1 || =5.3.10-r2 || =5.3.10-r3 || =5.3.10-r4 || =5.3.10-r5 || =5.3.12-r0 || =5.3.12-r1 || =5.3.12-r2 || =5.3.12-r3 || =5.3.15-r3 || =5.3.16-r0 || =5.3.17-r0 || =5.3.18-r0 || =5.3.19-r0 || =5.3.2-r0 || =5.3.2-r1 || =5.3.2-r2 || =5.3.2-r3 || =5.3.2-r4 || =5.3.2-r5 || =5.3.2-r6 || =5.3.2-r7 || =5.3.2-r8 || =5.3.20-r0 || =5.3.20-r1 || =5.3.21-r1 || =5.3.21-r2 || =5.3.23-r0 || =5.3.23-r1 || =5.3.3-r0 || =5.3.3-r1 || =5.3.3-r2 || =5.3.3-r3 || =5.3.3-r4 || =5.3.3-r5 || =5.3.4-r0 || =5.3.4-r1 || =5.3.4-r2 || =5.3.5-r0 || =5.3.5-r1 || =5.3.5-r2 || =5.3.5-r3 || =5.3.5-r4 || =5.3.5-r5 || =5.3.5-r6 || =5.3.5-r7 || =5.3.6-r0 || =5.3.6-r1 || =5.3.6-r10 || =5.3.6-r11 || =5.3.6-r2 || =5.3.6-r3 || =5.3.6-r4 || =5.3.6-r5 || =5.3.6-r6 || =5.3.6-r7 || =5.3.6-r8 || =5.3.6-r9 || =5.3.7-r0 || =5.3.7-r1 || =5.3.8-r0 || =5.3.8-r1 || =5.3.8-r2 || =5.3.9-r0 || =5.3.9-r1 || =5.4.14-r0 || =5.4.14-r1 || =5.4.14-r2 || =5.4.14-r3 || =5.4.15-r0 || =5.4.15-r1 || =5.4.16-r0 || =5.4.17-r0 || =5.4.17-r1 || =5.4.19-r0 || =5.4.20-r0 || =5.5.10-r0 || =5.5.11-r0 || =5.5.11-r1 || =5.5.12-r0 || =5.5.13-r0 || =5.5.13-r1 || =5.5.13-r2 || =5.5.13-r3 || =5.5.13-r4 || =5.5.14-r0 || =5.5.15-r0 || =5.5.15-r1 || =5.5.16-r0 || =5.5.4-r0 || =5.5.4-r1 || =5.5.5-r0 || =5.5.5-r1 || =5.5.5-r2 || =5.5.6-r0 || =5.5.6-r1 || =5.5.7-r0 || =5.5.8-r0 || =5.5.8-r1 || =5.5.9-r0 || =5.6.1-r0 || =5.6.1-r1 || =5.6.1-r2 || =5.6.10-r0 || =5.6.11-r0 || =5.6.12-r0 || =5.6.13-r0 || =5.6.14-r0 || =5.6.15-r0 || =5.6.15-r1 || =5.6.15-r2 || =5.6.15-r3 || =5.6.16-r0 || =5.6.17-r0 || =5.6.18-r0 || =5.6.18-r1 || =5.6.19-r0 || =5.6.19-r1 || =5.6.2-r0 || =5.6.2-r1 || =5.6.20-r0 || =5.6.21-r0 || =5.6.21-r1 || =5.6.21-r2 || =5.6.23-r0 || =5.6.24-r0 || =5.6.25-r0 || =5.6.26-r0 || =5.6.27-r0 || =5.6.28-r0 || =5.6.29-r0 || =5.6.3-r0 || =5.6.30-r0 || =5.6.31-r0 || =5.6.33-r0 || =5.6.34-r0 || =5.6.35-r0 || =5.6.4-r0 || =5.6.5-r0 || =5.6.5-r1 || =5.6.6-r0 || =5.6.7-r0 || =5.6.7-r1 || =5.6.8-r0 || =5.6.8-r1 || =5.6.9-r0 || =5.6.9-r1 || >=0 <5.6.36-r0 | 5.6.36-r0 | |
 rpm rhel6 | - | - | |
rpm rhel7 | <0:5.4.16-48.el7 | 0:5.4.16-48.el7 | |
rpm rhel5 | - | - | |
 packagist | >=0 <=5.6.32 || >=0 <=7.1.12 || >=7.0.0 <=7.0.26 || >=7.2.0 <=7.2.0 | - |
Aliases
1. CVE-2018-57122. NVD-2018-57123. OSV-ALPINE-2018-57124. OSV-2018-57125. GCVE-2018-57126. SECURITY-CVE-2018-57127. php.net8. php.net9. securityfocus.com10. securityfocus.com11. securitytracker.com12. access.redhat.com13. access.redhat.com14. lists.debian.org15. usn.ubuntu.com16. usn.ubuntu.com17. usn.ubuntu.com
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.