CVE-2004-0594 Race condition in n/a
Remote attackers can execute arbitrary code via a race condition in PHP's memory limit handling when register_globals is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2004-0594?
CVE-2004-0594 is a medium-severity vulnerability in Debian Debian Linux, published on 16 Jul 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.
Weakness: CWE-367
Which versions are affected by CVE-2004-0594?
It affects 6 products.
Products include Avaya Converged Communications Server, Debian Debian Linux, Hp Hp-Ux, Openpkg Openpkg, Php Php, Trustix Secure Linux.
How do I fix CVE-2004-0594?
Upgrade to a fixed version.
Is CVE-2004-0594 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-0594 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-jm2p-9h9p-vg22.