gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2014-08-23T01:00:00
Updated: 2024-08-06T11:34:37.424Z
Reserved: 2014-07-30T00:00:00
Link: CVE-2014-5120
Vulnrichment
No data.
NVD
Status : Modified
Published: 2014-08-23T01:55:02.103
Modified: 2016-10-26T02:00:09.597
Link: CVE-2014-5120
Redhat