CVE-2017-5630

A vulnerability was found in php-pear where if a malicious server responded to a pear

Since pear's purpose is to download libraries for inclusion in an application, any use of pear install or pear download implicitly trusts the server. This vulnerability does not significantly extend the trust already given to pear and to servers used with it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This vulnerability only allows files in the current directory to be overwritten, so using pear download in a temporary directory effectively mitigates the risk of a dangerous file overwrite occurring.