CVE-2004-0594
NoneCVSS
—
EPSS
54.9%
Published
Jul 27, 2004
CISA due date
—
The record
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:3.0 | php3 | 0 | 3:3.0.18-23.1woody2 |
| Debian:3.0 | php4 | 0 | 4.1.2-7 |
| Red Hat:enterprise_linux:3::as | php | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::as | php-debuginfo | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::as | php-devel | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::as | php-imap | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::as | php-ldap | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::as | php-mysql | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::as | php-odbc | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::as | php-pgsql | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::desktop | php | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::desktop | php-debuginfo | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::desktop | php-devel | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::desktop | php-imap | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::desktop | php-ldap | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::desktop | php-mysql | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::desktop | php-odbc | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::desktop | php-pgsql | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::es | php | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::es | php-debuginfo | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::es | php-devel | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::es | php-imap | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::es | php-ldap | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::es | php-mysql | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::es | php-odbc | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::es | php-pgsql | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::ws | php | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::ws | php-debuginfo | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::ws | php-devel | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::ws | php-imap | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::ws | php-ldap | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::ws | php-mysql | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::ws | php-odbc | 0 | 0:4.3.2-11.1.ent |
| Red Hat:enterprise_linux:3::ws | php-pgsql | 0 | 0:4.3.2-11.1.ent |
Related vulnerabilities
- CVE-2004-0595 The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter… Also affects php3
- CVE-2005-1921 Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc)… Also affects php4
- CVE-2009-4017 PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files… Also affects php
- CVE-2009-3546 The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD… Also affects php
- CVE-2007-1825 Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before… Also affects php
- CVE-2007-1286 Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to… Also affects php
- CVE-2007-1285 The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to… Also affects php
- CVE-2007-0908 The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5… Also affects php