QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2015-2348

Back to search

CVE-2015-2348

Published: Mar 30, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

VendorProductVersions

n/a

n/a

affected
n/a

References

HPSBMU03409
vendor-advisory
x_refsource_HP
APPLE-SA-2015-09-30-3
vendor-advisory
x_refsource_APPLE
HPSBMU03380
vendor-advisory
x_refsource_HP
SUSE-SU-2015:0868
vendor-advisory
x_refsource_SUSE
1032484
vdb-entry
x_refsource_SECTRACK
73434
vdb-entry
x_refsource_BID
USN-2572-1
vendor-advisory
x_refsource_UBUNTU
RHSA-2015:1135
vendor-advisory
x_refsource_REDHAT
RHSA-2015:1053
vendor-advisory
x_refsource_REDHAT
openSUSE-SU-2015:0684
vendor-advisory
x_refsource_SUSE
GLSA-201606-10
vendor-advisory
x_refsource_GENTOO
RHSA-2015:1066
vendor-advisory
x_refsource_REDHAT

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now
CVE-2015-2348 - Security Vulnerability | QwikSec