CVE-2014-5459

The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.

This issue did not affect the versions of php-pear as shipped with Red Hat Enterprise Linux 5, 6 and 7 as well as Red Hat Software Collections as they do not use a world-writable directory for storing PEAR cache data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.