CVE-2014-5120 in PHP
Résumé (Anglaise)
gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Réserver
30/07/2014
Divulgation
22/08/2014
Statut
Confirmé
Entrées
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnérabilité | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 67420 | PHP GD Extension imagewebp élévation de privilèges | 20 | Preuve de concept | Correctif officiel | CVE-2014-5120 |