CVE-2014-5120

medium · 6.4

gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.

6.4

CVSS

16.9%

EPSS (exploit prob.)

97th

EPSS percentile

2014-08-23

Published

AV:N/AC:L/Au:N/C:N/I:P/A:P

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
php	php	5.4.0
php	php	5.4.0
php	php	5.4.0
php	php	5.4.0
php	php	5.4.1
php	php	5.4.2
php	php	5.4.3
php	php	5.4.4
php	php	5.4.5
php	php	5.4.6
php	php	5.4.7
php	php	5.4.8
php	php	5.4.9
php	php	5.4.10
php	php	5.4.11
php	php	5.4.12
php	php	5.4.12
php	php	5.4.12
php	php	5.4.13
php	php	5.4.13
php	php	5.4.14
php	php	5.4.14
php	php	5.4.15
php	php	5.4.15
php	php	5.4.16
php	php	5.4.17
php	php	5.4.18
php	php	5.4.19
php	php	5.4.20
php	php	5.4.21
php	php	5.4.22
php	php	5.4.23
php	php	5.4.24
php	php	5.4.25
php	php	5.4.26
php	php	5.4.27
php	php	5.4.28
php	php	5.4.29
php	php	5.4.30
php	php	5.4.31

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-5120