CVE-2019-6338

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

Metrics

CVSS 3.0 8.0/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Drupal	Drupal core	>= 7.x, < 7.62; >= 8.6.x, < 8.6.6.; >= 8.5.x, < 8.5.9

References

http://www.securityfocus.com/bid/106706Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00032.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4370Third Party Advisory
https://www.drupal.org/sa-core-2019-001Patch, Vendor Advisory
http://www.securityfocus.com/bid/106706Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00032.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4370Third Party Advisory
https://www.drupal.org/sa-core-2019-001Patch, Vendor Advisory

Timeline

Published: Jan 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-63399.8In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PH CVE-2019-63408.1Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can CVE-2019-63415.4In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the CVE-2019-63429.8An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disablin CVE-2019-64389.8SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishandles 32-bit systems.CVE-2019-64399.8examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL through 3.15.7 has a heap-based buffer overflow.CVE-2019-64409.8Zemana AntiMalware before 3.0.658 Beta mishandles update logic.CVE-2019-64419.8An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices.CVE-2019-64426.5An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config re CVE-2019-64439.1An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in CVE-2019-64449.1An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-contr CVE-2019-64456.5An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control