Multiple vulnerabilities in PHP



| Updated: 2025-06-13
Risk High
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2004-1018
CVE-2004-1020
CWE-ID CWE-20
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Vulnerable software
 PHP
Universal components / Libraries / Scripting languages

Vendor PHP Group

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU110512

Risk: High

CVSSv4.0: N/A

CVE-ID: CVE-2004-1018

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PHP: 4.3 - 4.3.9

CPE2.3 External links

https://marc.info/?l=bugtraq&m=110314318531298&w=2
https://www.hardened-php.net/advisories/012004.txt
https://www.mandriva.com/security/advisories?name=MDKSA-2004:151
https://www.mandriva.com/security/advisories?name=MDKSA-2005:072
https://www.osvdb.org/12411
https://www.php.net/release_4_3_10.php
https://www.redhat.com/support/errata/RHSA-2005-032.html
https://www.redhat.com/support/errata/RHSA-2005-816.html
https://www.securityfocus.com/advisories/9028
https://www.securityfocus.com/archive/1/384920
https://www.securityfocus.com/bid/12045
https://bugzilla.fedora.us/show_bug.cgi?id=2344
https://exchange.xforce.ibmcloud.com/vulnerabilities/18515
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10949
https://www.ubuntu.com/usn/usn-99-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Input validation error

EUVDB-ID: #VU110514

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2004-1020

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PHP: 4.3.6 - 5.0.2

CPE2.3 External links

https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915
https://www.gentoo.org/security/en/glsa/glsa-200412-14.xml
https://www.mandriva.com/security/advisories?name=MDKSA-2004:151
https://www.php.net/release_4_3_10.php
https://www.securityfocus.com/advisories/9028
https://www.securityfocus.com/archive/1/384663
https://www.securityfocus.com/bid/11981
https://exchange.xforce.ibmcloud.com/vulnerabilities/18516


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###