Vulnerability CVE-2004-0594


Published: 2004-07-27   Modified: 2012-02-12

Description:
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.

Type:

CWE-Other

Vendor: Avaya
Product: S8500 
Version: r2.0.1; r2.0.0;
Product: S8700 
Version: r2.0.1; r2.0.0;
Product: S8300 
Version: r2.0.1; r2.0.0;
Product: Converged communications server 
Version: 2.0;
Product: Integrated management 
Vendor: Redhat
Product: Fedora core 
Version: core_2.0; core_1.0;
Vendor: PHP
Product: PHP 
Version:
5.0
4.3.7
4.3.6
4.3.5
4.3.3
4.3.2
4.3.1
4.3.0
4.3
4.2.3
4.2.2
4.2.1
4.2.0
4.2
4.1.2
4.1.1
4.1.0
4.0.7
4.0.6
4.0.5
4.0.4
4.0.3
4.0.2
4.0.1
4.0
3.0.9
3.0.8
3.0.7
3.0.6
3.0.5
3.0.4
3.0.3
3.0.2
3.0.18
3.0.17
3.0.16
3.0.15
3.0.14
3.0.13
3.0.12
3.0.11
3.0.10
3.0.1
3.0
Vendor: Trustix
Product: Secure linux 
Version:
2.1
2.0
1.5

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.1/10
6.4/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000847
http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023908.html
http://marc.info/?l=bugtraq&m=108981780109154&w=2
http://marc.info/?l=bugtraq&m=108982983426031&w=2
http://marc.info/?l=bugtraq&m=109051444105182&w=2
http://marc.info/?l=bugtraq&m=109181600614477&w=2
http://www.debian.org/security/2004/dsa-531
http://www.debian.org/security/2005/dsa-669
http://www.gentoo.org/security/en/glsa/glsa-200407-13.xml
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:068
http://www.novell.com/linux/security/advisories/2004_21_php4.html
http://www.redhat.com/support/errata/RHSA-2004-392.html
http://www.redhat.com/support/errata/RHSA-2004-395.html
http://www.redhat.com/support/errata/RHSA-2004-405.html
http://www.redhat.com/support/errata/RHSA-2005-816.html
http://www.securityfocus.com/bid/10725
http://www.trustix.org/errata/2004/0039/
https://exchange.xforce.ibmcloud.com/vulnerabilities/16693
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10896

Related CVE
CVE-2007-0907
Buffer underflow in PHP before 5.2.1 allows attackers to cause a denial of service via unspecified vectors involving the sapi_header_op function.
CVE-2007-0909
Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.
CVE-2007-0910
Unspecified vulnerability in PHP before 5.2.1 allows attackers to "clobber" certain super-global variables via unspecified vectors.
CVE-2007-0905
PHP before 5.2.1 allows attackers to bypass safe_mode and open_basedir restrictions via unspecified vectors in the session extension. NOTE: it is possible that this issue is a duplicate of CVE-2006-6383.
CVE-2007-0906
Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) s...
CVE-2005-3625
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and ...
CVE-2005-3626
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.
CVE-2005-3624
The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to int...

Copyright 2019, cxsecurity.com

 

Back to Top