CVE-2019-6338 third-party PEAR Archive_Tar library updates

What is CVE-2019-6338?

CVE-2019-6338 is a high-severity unsafe deserialization vulnerability in Debian Debian Linux, published on 22 Jan 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

Weakness: CWE-502

Which versions are affected by CVE-2019-6338?

7 open source packages ship an affected version, including drupal/drupal and drupal/core. It affects 2 products.

Products include Debian Debian Linux, Drupal Drupal.

How do I fix CVE-2019-6338?

Upgrade drupal/drupal to a fixed version for your release line: 7.62.0, 8.5.9 or 8.6.6.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2019-6338 being exploited?

There is no known exploitation of CVE-2019-6338 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DLA-1685-1, DRUPAL-CORE-2019-001, GHSA-6rmq-x2hv-vxpp, UBUNTU-CVE-2019-6338.