CVE-2014-5120

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:N/I:P/A:P

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Aug 23, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-51214.3Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script oCVE-2014-51225.8Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phCVE-2014-51275.8Open redirect vulnerability in Innovative Interfaces Encore Discovery Solution 4.3 allows remote attackers to redirect users to arbitrary weCVE-2014-51285.0Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitivCVE-2014-51294.3Cross-site scripting (XSS) vulnerability in Avolve Software ProjectDox 8.1 allows remote attackers to inject arbitrary web script or HTML viCVE-2014-51306.5Avolve Software ProjectDox 8.1 allows remote authenticated users to obtain sensitive information from other users via vectors involving a diCVE-2014-51316.5Avolve Software ProjectDox 8.1 makes it easier for remote authenticated users to obtain sensitive information by leveraging ciphertext reuseCVE-2014-51324.3Avolve Software ProjectDox 8.1 allows remote attackers to enumerate users via vectors related to email addresses.CVE-2014-51364.3Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject aCVE-2014-51375.0Innovative Interfaces Sierra Library Services Platform 1.2_3 provides different responses for login request depending on whether the user acCVE-2014-51387.5Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple instances of the same paraCVE-2014-51394.3The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL