PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade php-recodeUpgrade php-cliUpgrade php-gdUpgrade php-pspellUpgrade php-embeddedUpgrade php-enchantUpgrade php-snmpUpgrade php-soapUpgrade php-dbaUpgrade php-mysqlndUpgrade php-mysqlUpgrade php-xmlUpgrade php-processUpgrade php-xmlrpcUpgrade php-mbstringUpgrade phpUpgrade php-imapUpgrade php-pdoUpgrade php-ztsUpgrade php-ldapUpgrade php-bcmathUpgrade php-intlUpgrade php-fpmUpgrade php-pgsqlUpgrade php-develUpgrade php-odbcUpgrade php-commonUpgrade php-tidy | Dec 1, 2016 | May 16, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 7, 2015 |
| Oracle_linux | — | Upgrade php55-php-ldapUpgrade php54-php-commonUpgrade php-xmlrpcUpgrade php54-php-xmlrpcUpgrade php55-php-gmpUpgrade php55-php-fpmUpgrade php-snmpUpgrade php55-php-xmlUpgrade php-commonUpgrade php54-php-mbstringUpgrade php54-php-recodeUpgrade php-pdoUpgrade php-mbstringUpgrade php55-php-pdoUpgrade php55-php-bcmathUpgrade php-xmlUpgrade php54-php-odbcUpgrade php-bcmathUpgrade php54-php-enchantUpgrade php55-php-snmpUpgrade php-develUpgrade php54-phpUpgrade php-mysqlUpgrade php54-php-pspellUpgrade php54-php-fpmUpgrade php-recodeUpgrade php55-php-commonUpgrade php-ztsUpgrade php54-php-soapUpgrade php55-php-gdUpgrade php54-php-processUpgrade php-cliUpgrade php55-php-processUpgrade php54-php-intlUpgrade php55-php-cliUpgrade php54-php-dbaUpgrade php55-php-pspellUpgrade php55-php-soapUpgrade php55-php-mbstringUpgrade php-fpmUpgrade php-mysqlndUpgrade php-ldapUpgrade php-embeddedUpgrade php-pspellUpgrade php54-php-snmpUpgrade php55-php-intlUpgrade php-pgsqlUpgrade php-odbcUpgrade php55-php-dbaUpgrade phpUpgrade php55-php-xmlrpcUpgrade php54-php-ldapUpgrade php55-php-odbcUpgrade php54-php-gdUpgrade php-dbaUpgrade php-soapUpgrade php55-php-opcacheUpgrade php-enchantUpgrade php54-php-cliUpgrade php55-php-mysqlndUpgrade php55-php-pgsqlUpgrade php54-php-bcmathUpgrade php55-php-develUpgrade php-processUpgrade php54-php-pgsqlUpgrade php-intlUpgrade php54-php-mysqlndUpgrade php55-php-enchantUpgrade php-imapUpgrade php54-php-develUpgrade php55-phpUpgrade php54-php-tidyUpgrade php54-php-pdoUpgrade php55-php-recodeUpgrade php54-php-xmlUpgrade php-tidyUpgrade php54-php-imapUpgrade php-gd | Oct 16, 2024 | May 16, 2016 |
| Php | — | Upgrade to PHP version 5.5.26Upgrade to PHP version 5.6.10Upgrade to PHP version 5.4.42 | Jun 3, 2016 | May 16, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 28, 2015 |
| Suse | — | Upgrade php5-sysvmsgUpgrade php53-mcryptUpgrade php5-pcntlUpgrade php5-opensslUpgrade php53-develUpgrade php53-ctypeUpgrade php5-odbcUpgrade php5-xmlrpcUpgrade php5-fileinfoUpgrade php53-pgsqlUpgrade php5-zlibUpgrade php53-xslUpgrade php53-soapUpgrade php5-gdUpgrade php53-ldapUpgrade php5-pspellUpgrade php5-ldapUpgrade php53-fileinfoUpgrade php53-bcmathUpgrade php5-fpmUpgrade php5Upgrade php5-xslUpgrade php5-tokenizerUpgrade php5-sysvshmUpgrade php53-jsonUpgrade php5-socketsUpgrade php5-pgsqlUpgrade php5-pearUpgrade php5-dbaUpgrade php53-intlUpgrade php5-curlUpgrade php53-mysqlUpgrade php53-sqliteUpgrade php5-mysqlUpgrade php5-shmopUpgrade php5-intlUpgrade php5-sqliteUpgrade php53-calendarUpgrade php5-bcmathUpgrade php5-suhosinUpgrade php5-develUpgrade php53-sysvsemUpgrade php5-jsonUpgrade php5-wddxUpgrade php5-snmpUpgrade php53-mbstringUpgrade php5-mcryptUpgrade php5-fastcgiUpgrade php53-domUpgrade php5-xmlwriterUpgrade php53-ftpUpgrade php53-tidyUpgrade php53-gmpUpgrade php53-pcntlUpgrade php53-gettextUpgrade php5-pdoUpgrade php53-zipUpgrade php5-zipUpgrade php5-ftpUpgrade php53-pspellUpgrade php53-pdoUpgrade php53-snmpUpgrade php5-sysvsemUpgrade php53-posixUpgrade php53-opensslUpgrade php53-xmlrpcUpgrade php53-tokenizerUpgrade php5-iconvUpgrade php53-iconvUpgrade php53-sysvmsgUpgrade php53-wddxUpgrade php5-xmlreaderUpgrade php53-sysvshmUpgrade php5-domUpgrade php53-socketsUpgrade php5-bz2Upgrade php53-gdUpgrade php5-mbstringUpgrade php53-curlUpgrade php5-calendarUpgrade php53-zlibUpgrade php53-dbaUpgrade php5-gmpUpgrade php5-exifUpgrade php5-ctypeUpgrade php53-suhosinUpgrade php53-bz2Upgrade php53-exifUpgrade php53-readlineUpgrade php53-imapUpgrade php53-xmlreaderUpgrade apache2-mod_php5Upgrade php53Upgrade php5-soapUpgrade php53-odbcUpgrade apache2-mod_php53Upgrade php53-xmlwriterUpgrade php53-shmopUpgrade php53-fastcgiUpgrade php53-pearUpgrade php5-gettextUpgrade php5-enchant | Dec 18, 2015 | Jul 17, 2015 |
| Ubuntu | — | Upgrade libapache2-mod-php5Upgrade php5-cliUpgrade php5-fpmUpgrade php5-cgi | Nov 8, 2024 | May 16, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub