Input validation error in PHP - CVE-2014-5120
Published: August 23, 2014 / Updated: July 28, 2020
Vulnerability identifier: #VU32501
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-5120
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.
gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
Affected software
PHP
Gentoo Linux
Amazon Linux AMI
Slackware Linux
php (Alpine package)
dev-lang/php
Gentoo Linux
Amazon Linux AMI
Slackware Linux
php (Alpine package)
dev-lang/php
How to mitigate CVE-2014-5120
Install update from vendor's website.
PHP - update to 5.4.32
php (Alpine package) - update to 5.5.16-r0
dev-lang/php - update to 5.5.16
php (Alpine package) - update to 5.5.16-r0
dev-lang/php - update to 5.5.16
External References
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html
- http://php.net/ChangeLog-5.php
- http://rhn.redhat.com/errata/RHSA-2014-1327.html
- http://rhn.redhat.com/errata/RHSA-2014-1765.html
- http://rhn.redhat.com/errata/RHSA-2014-1766.html
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- https://bugs.php.net/bug.php?id=67730
- https://support.apple.com/HT204659