Bug 893855 (CVE-2014-5120) - VUL-0: CVE-2014-5120: php5, php53: php5-gd, php53-gd: NUL byte injection in filenames passed to image handling functions
Summary: VUL-0: CVE-2014-5120: php5, php53: php5-gd, php53-gd: NUL byte injection in f...
Status: RESOLVED FIXED
Alias: CVE-2014-5120
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/105273/
Whiteboard: CVSSv2:NVD:CVE-2014-5120:6.4:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-08-27 16:23 UTC by Alexander Bergmann
Modified: 2019-05-01 16:17 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2014-08-27 16:23:44 UTC 
rh#1132793

gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16
does not ensure that pathnames lack %00 sequences, which might allow remote
attackers to overwrite arbitrary files via crafted input to an application that
calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng,
(6) imagewbmp, or (7) imagewebp function.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1132793
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5120
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-5120.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5120
https://bugs.php.net/bug.php?id=67730
Comment 1 Alexander Bergmann 2014-08-27 16:25:33 UTC 
Comment inside the php bug:

"The issue was introduced with 5.4..."

Therefore closing as invalid.
Comment 2 Marcus Meissner 2014-08-27 19:28:35 UTC 
SLE12 GA has 5.5.14. we canm even try a version update, or at least backports before GA.
Comment 3 Swamp Workflow Management 2014-08-27 22:00:37 UTC 
bugbot adjusting priority
Comment 4 Petr Gajdos 2014-08-29 12:54:59 UTC 
php5 submitted into sle12.
Comment 7 Petr Gajdos 2014-09-10 08:47:16 UTC 
If I understand correctly, CVE-2006-7243 was assigned to this issue in the past. It was corrected upstream in php 5.3.4 and thus php53 is not affected. Unfortunately, the fix was not merged into 5.4 branch sufficiently, so 5.4 and 5.5 branch is affected by CVE-2014-5120. Therefore submitting to 13.1 too.
Comment 8 Petr Gajdos 2014-09-10 08:59:19 UTC 
Packages submitted.
Comment 9 Marcus Meissner 2014-09-16 12:44:22 UTC 
released
Comment 10 Swamp Workflow Management 2014-09-16 13:06:44 UTC 
openSUSE-SU-2014:1133-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 893849,893853,893855,895658
CVE References: CVE-2014-3597,CVE-2014-5120,CVE-2014-5459
Sources used:
openSUSE 13.1 (src):    php5-5.4.20-30.1
openSUSE 12.3 (src):    php5-5.3.17-3.34.1