Critical severity9.8NVD Advisory· Published Feb 6, 2017· Updated May 13, 2026
CVE-2017-5677
CVE-2017-5677
Description
PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression.
Affected products
15cpe:2.3:a:pear:html_ajax:0.3.0:*:*:*:*:*:*:*+ 14 more
- cpe:2.3:a:pear:html_ajax:0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:pear:html_ajax:0.5.7:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- blog.pear.php.net/2017/02/02/security-html_ajax-058/nvdVendor Advisory
- karmainsecurity.com/KIS-2017-01nvdThird Party Advisory
- seclists.org/fulldisclosure/2017/Feb/12nvdMailing ListThird Party Advisory
- www.securityfocus.com/bid/96044nvdThird Party AdvisoryVDB Entry
- gitweb.gentoo.org/repo/gentoo.git/commit/nvdThird Party Advisory
- pear.php.net/bugs/bug.phpnvdVendor Advisory
News mentions
0No linked articles in our index yet.