CVE-2014-5120 in PHP
Resumen (Inglés)
gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
Reservar
2014-07-30
Divulgación
2014-08-22
Voces
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidad | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 67420 | PHP GD Extension imagewebp escalada de privilegios | 20 | Prueba de concepto | Arreglo oficial | CVE-2014-5120 |