gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2014-08-23T01:00:00

Updated: 2024-08-06T11:34:37.424Z

Reserved: 2014-07-30T00:00:00

Link: CVE-2014-5120

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2014-08-23T01:55:02.103

Modified: 2016-10-26T02:00:09.597

Link: CVE-2014-5120

cve-icon Redhat

Severity : Moderate

Publid Date: 2014-07-31T00:00:00Z

Links: CVE-2014-5120 - Bugzilla