NetSight
IP …
medium4.3

CVE-2014-9767

Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13…

Impact

Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.

Affected products

VendorProductAffected versions
PhpPhp
through 5.4.45
Versions 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4
Hiphop Virtual Machine For Php ProjectHiphop Virtual Machine For Php
through 3.12

Weakness classification

CWE-22

References