CVE-2014-5459

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.0 PEAR (affected versions not specified)

Description The issue allows local users to write to arbitrary files via a symlink attack on a rest.cachefile or rest.cacheid file in /tmp/pear/cache. This is related to the retrieveCacheFirst and useLocalCache functions in the PEAR REST class in REST.php.

Recommendations For PHP versions prior to 5.6.0, consider updating to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the /tmp/pear/cache/ directory to minimize the risk of exploitation. Avoid using the retrieveCacheFirst and useLocalCache functions in the PEAR REST class until the issue is resolved.