6.4

CVE-2014-5120

gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Php ≫ Php Version 5.4.0
Php ≫ Php Version 5.4.0 Update beta2
Php ≫ Php Version 5.4.0 Update beta2 Edition 32-bit
Php ≫ Php Version 5.4.0 Update rc2
Php ≫ Php Version 5.4.1
Php ≫ Php Version 5.4.2
Php ≫ Php Version 5.4.3
Php ≫ Php Version 5.4.4
Php ≫ Php Version 5.4.5
Php ≫ Php Version 5.4.6
Php ≫ Php Version 5.4.7
Php ≫ Php Version 5.4.8
Php ≫ Php Version 5.4.9
Php ≫ Php Version 5.4.10
Php ≫ Php Version 5.4.11
Php ≫ Php Version 5.4.12
Php ≫ Php Version 5.4.12 Update rc1
Php ≫ Php Version 5.4.12 Update rc2
Php ≫ Php Version 5.4.13
Php ≫ Php Version 5.4.13 Update rc1
Php ≫ Php Version 5.4.14
Php ≫ Php Version 5.4.14 Update rc1
Php ≫ Php Version 5.4.15
Php ≫ Php Version 5.4.15 Update rc1
Php ≫ Php Version 5.4.16 Update rc1
Php ≫ Php Version 5.4.17
Php ≫ Php Version 5.4.18
Php ≫ Php Version 5.4.19
Php ≫ Php Version 5.4.20
Php ≫ Php Version 5.4.21
Php ≫ Php Version 5.4.22
Php ≫ Php Version 5.4.23
Php ≫ Php Version 5.4.24
Php ≫ Php Version 5.4.25
Php ≫ Php Version 5.4.26
Php ≫ Php Version 5.4.27
Php ≫ Php Version 5.4.28
Php ≫ Php Version 5.4.29
Php ≫ Php Version 5.4.30
Php ≫ Php Version 5.4.31
Php ≫ Php Version 5.5.0
Php ≫ Php Version 5.5.0 Update alpha1
Php ≫ Php Version 5.5.0 Update alpha2
Php ≫ Php Version 5.5.0 Update alpha3
Php ≫ Php Version 5.5.0 Update alpha4
Php ≫ Php Version 5.5.0 Update alpha5
Php ≫ Php Version 5.5.0 Update alpha6
Php ≫ Php Version 5.5.0 Update beta1
Php ≫ Php Version 5.5.0 Update beta2
Php ≫ Php Version 5.5.0 Update beta3
Php ≫ Php Version 5.5.0 Update beta4
Php ≫ Php Version 5.5.0 Update rc1
Php ≫ Php Version 5.5.0 Update rc2
Php ≫ Php Version 5.5.1
Php ≫ Php Version 5.5.2
Php ≫ Php Version 5.5.3
Php ≫ Php Version 5.5.4
Php ≫ Php Version 5.5.5
Php ≫ Php Version 5.5.6
Php ≫ Php Version 5.5.7
Php ≫ Php Version 5.5.8
Php ≫ Php Version 5.5.9
Php ≫ Php Version 5.5.10
Php ≫ Php Version 5.5.11
Php ≫ Php Version 5.5.12
Php ≫ Php Version 5.5.13
Php ≫ Php Version 5.5.14
Php ≫ Php Version 5.5.15
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 16.93% 0.967
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.4 10 4.9
AV:N/AC:L/Au:N/C:N/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://php.net/ChangeLog-5.php
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://rhn.redhat.com/errata/RHSA-2014-1765.html
https://support.apple.com/HT204659
http://rhn.redhat.com/errata/RHSA-2014-1327.html
http://rhn.redhat.com/errata/RHSA-2014-1766.html
http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html
https://bugs.php.net/bug.php?id=67730
Vendor Advisory