CVE catalog
CVE-2017-5630
php-pear: CVE-2017-5630
- Severity
- Low · CVSS 3.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 12.51% · Oct 25, 2026
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php-pear | sid | 1:1.10.16+submodules+notgz-3 | vulnerable |
| Debian | php-pear | forky | 1:1.10.16+submodules+notgz-3 | vulnerable |
| Debian | php-pear | trixie | 1:1.10.16+submodules+notgz-3 | vulnerable |
| Debian | php-pear | bookworm | 1:1.10.13+submodules+notgz+2022032202-2 | vulnerable |
| Ubuntu | php5 | pro | 5.5.3+dfsg-1ubuntu2 | vulnerable |
| Ubuntu | php5 | pro | 5.5.3+dfsg-1ubuntu3 | vulnerable |
| Ubuntu | php5 | pro | 5.5.6+dfsg-1ubuntu1 | vulnerable |
| Ubuntu | php5 | pro | 5.5.6+dfsg-1ubuntu2 | vulnerable |
| Ubuntu | php5 | pro | 5.5.8+dfsg-2ubuntu1 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu1 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu2 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu3 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.1 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.2 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.3 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.4 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.5 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.6 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.7 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.9 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.11 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.12 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.13 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.14 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.16 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.17 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.19 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.20 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.21 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.22 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.23 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.24 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.25 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.26 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.27 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm1 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm2 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm3 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm4 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm5 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm6 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm8 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm10 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm11 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm12 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm13 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm14 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm15 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm16 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm17 | vulnerable |
| Ubuntu | php5 | pro | 5.5.9+dfsg-1ubuntu4.29+esm18 | vulnerable |
| Ubuntu | php-pear | pro | 1:1.10.1+submodules+notgz-4 | vulnerable |
| Ubuntu | php-pear | pro | 1:1.10.1+submodules+notgz-6 | vulnerable |
| Ubuntu | php-pear | pro | 1:1.10.1+submodules+notgz-6ubuntu0.1 | vulnerable |
| Ubuntu | php-pear | pro | 1:1.10.1+submodules+notgz-6ubuntu0.2 | vulnerable |
| Ubuntu | php-pear | pro | 1:1.10.1+submodules+notgz-6ubuntu0.3 | vulnerable |
| Ubuntu | php-pear | pro | 1:1.10.1+submodules+notgz-6ubuntu0.3+esm1 | vulnerable |
| Ubuntu | php-pear | 18.04 | 1:1.10.5+submodules+notgz-1 | vulnerable |
| Ubuntu | php-pear | 18.04 | 1:1.10.5+submodules+notgz-1ubuntu1 | vulnerable |
| Ubuntu | php-pear | 18.04 | 1:1.10.5+submodules+notgz-1ubuntu1.18.04.1 | vulnerable |
| Ubuntu | php-pear | 18.04 | 1:1.10.5+submodules+notgz-1ubuntu1.18.04.2 | vulnerable |
| Ubuntu | php-pear | 18.04 | 1:1.10.5+submodules+notgz-1ubuntu1.18.04.3 | vulnerable |
| Ubuntu | php-pear | 18.04 | 1:1.10.5+submodules+notgz-1ubuntu1.18.04.4 | vulnerable |
| Ubuntu | php-pear | 20.04 | 1:1.10.9+submodules+notgz-1 | vulnerable |
| Ubuntu | php-pear | 20.04 | 1:1.10.9+submodules+notgz-1ubuntu0.20.04.1 | vulnerable |
| Ubuntu | php-pear | 20.04 | 1:1.10.9+submodules+notgz-1ubuntu0.20.04.2 | vulnerable |
| Ubuntu | php-pear | 20.04 | 1:1.10.9+submodules+notgz-1ubuntu0.20.04.3 | vulnerable |
| Ubuntu | php-pear | 22.04 | 1:1.10.12+submodules+notgz+20210212-1ubuntu1 | vulnerable |
| Ubuntu | php-pear | 22.04 | 1:1.10.12+submodules+notgz+20210212-1ubuntu3 | vulnerable |
| Ubuntu | php-pear | 24.04 | 1:1.10.13+submodules+notgz+2022032202-2build1 | vulnerable |
| Ubuntu | php-pear | 25.10 | 1:1.10.13+submodules+notgz+2022032202-2build1 | vulnerable |
| Ubuntu | php-pear | 25.10 | 1:1.10.16+submodules+notgz-3 | vulnerable |
| Ubuntu | php-pear | 26.10 | 1:1.10.16+submodules+notgz-3ubuntu1 | vulnerable |
| Ubuntu | php-pear | 26.04 | 1:1.10.16+submodules+notgz-3 | vulnerable |
| Ubuntu | php-pear | 26.04 | 1:1.10.16+submodules+notgz-3build1 | vulnerable |
| Ubuntu | php-pear | 26.04 | 1:1.10.16+submodules+notgz-3ubuntu1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | php-pear | source | sid | (unfixed) | unimportant | Not reported | Not reported |
| Debian | php-pear | source | forky | (unfixed) | unimportant | Not reported | Not reported |
| Debian | php-pear | source | trixie | (unfixed) | unimportant | Not reported | Not reported |
| Debian | php-pear | source | bookworm | (unfixed) | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [php-pear]Affected
Details (2)
1:1.10.13+submodules+notgz+2022032202-2· all · bookwormAffected
dsa · php-pear · debian · bookworm; dsa · php-pear · debian · 12
1:1.10.13+submodules+notgz+2022032202-2· all · bookwormAffected
dsa · php-pear · debian · bookworm; dsa · php-pear · debian · 12
[Debian 13 (Trixie)]
- [php-pear]Affected
Details (2)
1:1.10.16+submodules+notgz-3· all · trixieAffected
dsa · php-pear · debian · 13
1:1.10.16+submodules+notgz-3· all · trixieAffected
dsa · php-pear · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2017-5630]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2017-5630]
- [https://security-tracker.debian.org/tracker/CVE-2017-5630]
- [https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-5630.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]