Vulnerability Bulletins

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2019-002

Affected software	Drupal

Project: Drupal coreDate: 2019-January-16Security risk: Critical 16∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Arbitrary PHP code executionCVE IDs: CVE-2019-6339Description: A remote code execution vulnerability exists in PHPs built-in phar stream wrapper when performing file operations on an untrusted phar:// URI.Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this More info: https://www.drupal.org/sa-core-2019-002

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2019-002