CVE-2004-1019 Deserialization in n/a
Remote attackers can execute arbitrary code or cause denial of service via malicious data passed to PHP's unserialize function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2004-1019?
CVE-2004-1019 is a critical unsafe deserialization vulnerability in Php Php, published on 22 Dec 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results.
Weakness: CWE-20
Which versions are affected by CVE-2004-1019?
It affects 4 products.
Products include Openpkg Openpkg, Php Php, Trustix Secure Linux, Ubuntu Ubuntu Linux.
How do I fix CVE-2004-1019?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2004-1019 being exploited?
There is no known exploitation of CVE-2004-1019 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-8xg9-g9f5-rcr7.