CVE-2014-5120

Name of the Vulnerable Software and Affected Versions PHP versions 5.4.x through 5.4.31 PHP versions 5.5.x through 5.5.15

Description The issue exists in the GD component of PHP due to the presence of %00 sequences in pathnames. This allows remote attackers to overwrite arbitrary files by providing crafted input to applications that call certain functions, including imagegd, imagegd2, imagegif, imagejpeg, imagepng, imagewbmp, or imagewebp.

Recommendations For PHP versions 5.4.x through 5.4.31, update to version 5.4.32 or later. For PHP versions 5.5.x through 5.5.15, update to version 5.5.16 or later.