CVE-2014-5120 in PHP
Сводка (Английский)
gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
Резервировать
30.07.2014
Раскрытие
22.08.2014
Записи
VulDB provides additional information and datapoints for this CVE:
| ИД | Уязвимость | CWE | Экс | Кон | CVE |
|---|---|---|---|---|---|
| 67420 | PHP GD Extension imagewebp эскалация привилегий | 20 | Доказательство концепции | Официальное исправление | CVE-2014-5120 |