SB2025070240 - Ubuntu update for composer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025070240

SB2025070240 - Ubuntu update for composer

Published: July 2, 2025

Security Bulletin ID SB2025070240
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2022-24828)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the VcsDriver::getFileContent() method when parsing $file or $identifier arguments. A remote attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system, if the Mercurial or the Git driver are used.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Code Injection (CVE-ID: CVE-2023-43655)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper access restrictions. A remote attacker can send a specially crafted request to the server with published composer.phar and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that "register_argc_argv" option is enabled in php.ini.


3) Incorrect default permissions (CVE-ID: CVE-2024-24821)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to several files within the local working directory are included during the invocation of Composer and in the context of the executing user. A local user can execute arbitrary code with elevated privileges via the compromised InstalledVersions.php or installed.php files.


4) Command Injection (CVE-ID: CVE-2024-35241)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the "status", "reinstall" and "remove" commands within git branch name. A remote attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


5) Command Injection (CVE-ID: CVE-2024-35242)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber



Remediation

Install update from vendor's website.

References