CVE-2014-2020
Severity CVSS v4.0:
Pending analysis
Type:
CWE-189
Numeric Errors
Publication date:
18/02/2014
Last modified:
11/04/2025
Description
ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226.
Impact
Base Score 2.0
5.00
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* | 5.5.8 (including) | |
cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://www.ubuntu.com/usn/USN-2126-1
- https://bugs.php.net/bug.php?id=66356
- https://github.com/php/php-src/commit/2938329ce19cb8c4197dec146c3ec887c6f61d01
- http://www.ubuntu.com/usn/USN-2126-1
- https://bugs.php.net/bug.php?id=66356
- https://github.com/php/php-src/commit/2938329ce19cb8c4197dec146c3ec887c6f61d01