QwikSec

Security Database

CVE

CWE

Training

CVE-2004-1019

Published: Dec 22, 2004

Modified: Aug 8, 2024

PUBLISHED

Description

The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

x_refsource_REDHAT

php-unserialize-code-execution(18514)

vdb-entry

x_refsource_XF

SUSE-SU-2015:0365

vendor-advisory

x_refsource_SUSE

SUSE-SA:2005:002

vendor-advisory

x_refsource_SUSE

http://www.php.net/release_4_3_10.php

x_refsource_CONFIRM

openSUSE-SU-2015:0325

vendor-advisory

x_refsource_SUSE

oval:org.mitre.oval:def:10511

vdb-entry

signature

x_refsource_OVAL

vendor-advisory

x_refsource_REDHAT

vendor-advisory

x_refsource_MANDRAKE

http://www.hardened-php.net/advisories/012004.txt

x_refsource_MISC

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_FEDORA

OpenPKG-SA-2004.053

vendor-advisory

x_refsource_OPENPKG

vendor-advisory

x_refsource_HP

vendor-advisory

x_refsource_REDHAT

20041215 Advisory 01/2004: Multiple vulnerabilities in PHP 4/5

mailing-list

x_refsource_BUGTRAQ

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.