From 81aecee0eda7600e6a6ae3f8264b2a1bc7a57f04 Mon Sep 17 00:00:00 2001 From: Yue Tao Date: Thu, 23 Oct 2014 16:29:13 +0800 Subject: modphp: Security Advisory - php - CVE-2014-5120 gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5120 Signed-off-by: Yue Tao Signed-off-by: Martin Jansa --- meta-webserver/recipes-php/modphp/modphp5.inc | 1 + 1 file changed, 1 insertion(+) (limited to 'meta-webserver/recipes-php/modphp/modphp5.inc') diff --git a/meta-webserver/recipes-php/modphp/modphp5.inc b/meta-webserver/recipes-php/modphp/modphp5.inc index 0d7bb7a13c..6a2a61f5f7 100644 --- a/meta-webserver/recipes-php/modphp/modphp5.inc +++ b/meta-webserver/recipes-php/modphp/modphp5.inc @@ -9,6 +9,7 @@ SRC_URI = "http://www.php.net/distributions/php-${PV}.tar.bz2 \ file://pthread-check-threads-m4.patch \ file://70_mod_php5.conf \ file://0001-using-pkgconfig-to-check-libxml.patch \ + file://php-CVE-2014-5120.patch \ " S = "${WORKDIR}/php-${PV}" -- cgit v1.2.3-54-g00ecf