CVE-2015-2348

Published: 30 March 2015

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

Priority

Status

Package	Release	Status
php5 Launchpad, Ubuntu, Debian	Upstream	Released (5.6.7)





	Ubuntu 14.04 ESM (Trusty Tahr)	Released (5.5.9+dfsg-1ubuntu4.9)
	Patches: Upstream: http://git.php.net/?p=php-src.git;a=commit;h=1291d6bbee93b6109eb07e8f7916ff1b7fcc13e1

Notes

Author	Note
mdeslaur	fixed in lucid's php5-CVE-2006-7243.patch, and is fixed in precise also. Seems to be a regression in 5.4+

References

Bugs

https://bugs.php.net/bug.php?id=69207

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM

Further reading