Description
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.
Affected products
- Avaya / converged_communications_server2.0 – 2.0
- Debian / debian_linux3.0 – 3.0
- HP / hp-uxb.11.23 – b.11.23
- HP / hp-uxb.11.11 – b.11.11
- HP / hp-uxb.11.22 – b.11.22
- HP / hp-uxb.11.00 – b.11.00
- openpkg / openpkg2.1 – 2.1
- openpkg / openpkg2.0 – 2.0
- php / PHP5.0.0 – 5.0.0
- php / PHP5.0.0 – 5.0.0
- php / PHP5.0.0 – 5.0.0
- php / PHP5.0.0 – 5.0.0
- php / PHP4.0 – 4.3.7
- php / PHP5.0.0 – 5.0.0
- php / PHP5.0.0 – 5.0.0
- trustix / secure_linux2.0 – 2.0
- trustix / secure_linux2.1 – 2.1
- trustix / secure_linux1.5 – 1.5
References
- MISChttp://www.trustix.org/errata/2004/0039/
- MAILING_LISThttp://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023908.html
- MISChttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000847
- MAILING_LISThttp://marc.info/?l=bugtraq&m=108982983426031&w=2
- VENDOR_ADVISORYhttp://www.debian.org/security/2005/dsa-669
- MISChttp://www.redhat.com/support/errata/RHSA-2004-395.html
- MISChttp://www.redhat.com/support/errata/RHSA-2004-405.html
- MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10896
- MISChttp://www.redhat.com/support/errata/RHSA-2004-392.html
- VENDOR_ADVISORYhttp://www.debian.org/security/2004/dsa-531
- VENDOR_ADVISORYhttp://www.novell.com/linux/security/advisories/2004_21_php4.html
- VENDOR_ADVISORYhttp://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:068
- MISChttp://www.redhat.com/support/errata/RHSA-2005-816.html
- MAILING_LISThttp://marc.info/?l=bugtraq&m=109181600614477&w=2
- MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/16693
- MAILING_LISThttp://marc.info/?l=bugtraq&m=109051444105182&w=2
- MISChttp://www.securityfocus.com/bid/10725
- MAILING_LISThttp://marc.info/?l=bugtraq&m=108981780109154&w=2
- MISChttp://www.gentoo.org/security/en/glsa/glsa-200407-13.xml