CVE-2004-0594

medium · 5.1

The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.

5.1

CVSS

54.9%

EPSS (exploit prob.)

99th

EPSS percentile

2004-07-27

Published

AV:N/AC:H/Au:N/C:P/I:P/A:P

Weaknesses

CWE-367

Affected products

Vendor	Product	Affected versions
openpkg	openpkg	2.0
openpkg	openpkg	2.1
avaya	converged_communications_server	2.0
debian	debian_linux	3.0
hp	hp-ux	b.11.00
hp	hp-ux	b.11.11
hp	hp-ux	b.11.22
hp	hp-ux	b.11.23
trustix	secure_linux	1.5
trustix	secure_linux	2.0
trustix	secure_linux	2.1
php	php	>= 4.0, < 4.3.7
php	php	5.0.0
php	php	5.0.0
php	php	5.0.0
php	php	5.0.0
php	php	5.0.0
php	php	5.0.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2004-0594