CVE-2014-5120

gdctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the 1 imagegd, 2 imagegd2, 3 imagegif, 4 imagejpeg, 5...

PT-2014-1420

Name of the Vulnerable Software and Affected Versions PHP versions 5.4.x through 5.4.31 PHP versions 5.5.x through 5.5.15 Description The issue exists in the GD component of PHP due to the presence of %00 sequences in pathnames. This allows remote attackers to overwrite arbitrary files by providi...