PT-2014-1420 · Php+2 · Php+2

Published 2014-08-23 · Updated 2024-06-15 · CVE-2014-5120

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 5.4.x through 5.4.31 PHP versions 5.5.x through 5.5.15

Description The issue exists in the GD component of PHP due to the presence of %00 sequences in pathnames. This allows remote attackers to overwrite arbitrary files by providing crafted input to applications that call certain functions, including imagegd, imagegd2, imagegif, imagejpeg, imagepng, imagewbmp, or imagewebp.

Recommendations For PHP versions 5.4.x through 5.4.31, update to version 5.4.32 or later. For PHP versions 5.5.x through 5.5.15, update to version 5.5.16 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-00375

CESA-2014_1327

CVE-2014-5120

MGASA-2014-0367

OPENSUSE-SU-2024:10290-1

OPENSUSE-SU-2024:10344-1

RHSA-2014:1327

RHSA-2014:1765

RHSA-2014:1766

RHSA-2014_1327

Affected Products

Centos

Php

Red Hat

References · 130

• https://osv.dev/vulnerability/openSUSE-SU-2024:10344-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0367.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3597 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2497 · Security Note
• https://bdu.fstec.ru/vul/2015-00374 · Security Note
• https://bdu.fstec.ru/vul/2015-00367 · Security Note
• https://bdu.fstec.ru/vul/2015-00370 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-5120 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1765.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-1327.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3538 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5120 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4698 · Security Note
• https://bdu.fstec.ru/vul/2015-00366 · Security Note