CVE-2004-1018 Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmo...
HighCVSS 10.0
EPSS 16.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | < 4.3.10 | 4.3.10 |
| Canonical Ubuntu Linux | = 4.10 | No fix listed |
References
- 20041215 Advisory 01/2004: Multiple vulnerabilities in PHP 4/5 issue-tracking mailing-list third-party-advisory
- www.hardened-php.net third-party-advisory
- MDKSA-2004:151 third-party-advisory vendor-advisory
- MDKSA-2005:072 third-party-advisory vendor-advisory
- 12411 broken-link vdb-entry
- www.php.net release-notes vendor-advisory
- RHSA-2005:032 third-party-advisory vendor-advisory
- RHSA-2005:816 third-party-advisory vendor-advisory
- HPSBMA01212 third-party-advisory vdb-entry vendor-advisory
- 20041219 PHP shmop.c module permits write of arbitrary memory. mailing-list third-party-advisory vdb-entry
- 12045 third-party-advisory vdb-entry
- FLSA:2344 broken-link vendor-advisory
- php-shmopwrite-outofbounds-memory(18515) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:10949 signature third-party-advisory vdb-entry
- USN-99-1 third-party-advisory vendor-advisory