2025 matches found
gd: NULL pointer dereference in gdImageCreateFromXpm()
A NULL pointer dereference flaw was found in the gdImageCreateFromXpm function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application using gd via a specially crafted X PixMap XPM file...
php: gd extension NUL byte injection in file names
It was found that PHP's gd extension did not properly handle file names with a null character. A remote attacker could possibly use this flaw to make a PHP application access unexpected files and bypass intended file system access restrictions...
Moderate: Red Hat Security Advisory: php53 and php security update
Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severi...
php53 and php security update
5.3.3-27.2 - spl: fix use-after-free in ArrayIterator due to object change during sorting. CVE-2014-4698 - spl: fix use-after-free in SPL Iterators. CVE-2014-4670 - gd: fix NULL pointer dereference in gdImageCreateFromXpm. CVE-2014-2497 - fileinfo: fix incomplete fix for CVE-2012-1571 in...
php security update
5.4.16-23.1 - gd: fix NULL pointer dereference in gdImageCreateFromXpm. CVE-2014-2497 - gd: fix NUL byte injection in file names. CVE-2014-5120 - fileinfo: fix extensive backtracking in regular expression incomplete fix for CVE-2013-7345. CVE-2014-3538 - fileinfo: fix mconvert incorrect handling ...
Medium: php55
Issue Overview: A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. gdctx.c in the GD component i...
PHP security vulnerabilities
Fileinfo and phpparserr buffer overflows. GD poisoned NULL byte vulnerability...
Mandriva Linux Security Advisory : php (MDVSA-2014:172)
Multiple vulnerabilities has been discovered and corrected in php : The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted color table in an XPM fil...
Fedora 19 : php-5.5.16-1.fc19 (2014-9679)
21 Aug 2014, PHP 5.5.16 Core : - Fixed bug 67693 incorrect push to the empty array Tjerk - Fixed bug 67717 segfault in dnsgetrecord. CVE-2014-3597 Remi COM : - Fixed missing type checks in comeventsink Yussuf Khalil, Stas. Fileinfo : - Fixed bug 67705 extensive backtracking in rule regular...
PHP 5.4.x < 5.4.32 / 5.5.x < 5.5.16 Multiple Vulnerabilities
Binary data 8360.prm...
CVE-2014-5120
gdctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the 1 imagegd, 2 imagegd2, 3 imagegif, 4 imagejpeg, 5...
Code injection
gdctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the 1 imagegd, 2 imagegd2, 3 imagegif, 4 imagejpeg, 5...
CVE-2014-5120
gdctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the 1 imagegd, 2 imagegd2, 3 imagegif, 4 imagejpeg, 5...
CVE-2014-5120
gdctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the 1 imagegd, 2 imagegd2, 3 imagegif, 4 imagejpeg, 5...
CVE-2014-5120
CVE-2014-5120 affects the PHP GD extension. gd_ctx.c does not ensure that pathnames lack a NUL (%00) sequence, enabling remote attackers to overwrite arbitrary files via crafted input when calling the imagegd, imagegd2, imagegif, imagejpeg, imagepng, imagewbmp, or imagewebp functions. Affected ve...
CVE-2014-5120
gdctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the 1 imagegd, 2 imagegd2, 3 imagegif, 4 imagejpeg, 5...
[SECURITY] Fedora 20 Update: gd-2.1.0-6.fc20
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...
Fedora 20 : gd-2.1.0-6.fc20 (2014-8458)
CVE-2014-2497 gd: NULL pointer dereference in : gdImageCreateFromXpm Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...
Fedora Update for gd FEDORA-2014-8458
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
