CVE-2014-5120 Path traversal in n/a
Remote attackers can overwrite arbitrary files via null byte injection in PHP GD image functions, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-5120?
CVE-2014-5120 is a medium-severity path traversal vulnerability in Php Php, published on 23 Aug 2014. It can be exploited over the network, with no action from the victim.
Official description
gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
Weakness: CWE-20
Which versions are affected by CVE-2014-5120?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2014-5120?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2014-5120 being exploited?
There is no known exploitation of CVE-2014-5120 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-3wv8-w3p3-hq59.