CVE-2014-5120

gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote…

published August 23, 2014

CVSS
—
EPSS
17%
Percentile
97.1
In the wild
Unconfirmed
What it is

gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.16934 · 97.1th percentile
Published
2014-08-23T01:00Z
EPSS history
Timeline
  • 23 AUG 01:00Z
    gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote…
    cvelistv5