CVE-2014-5459: Opensuse Evergreen

Low severity, CVSS 3.6. EPSS: 0.6% chance of exploitation in the next 30 days.

The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.

Affected products

• Opensuse Evergreen: version 11.4 only
• Opensuse Opensuse: version 12.3 only; version 13.1 only
• Oracle Solaris: version 11.2 only
• PHP PHP: up to and including 5.6.0

Published 2014-09-27. Last modified 2026-06-17.