CVE-2004-1018
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode...
CVE-2004-1018 is a high vulnerability (CVSS 10.0) in Php, published December 8, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 16.2%, the 96th percentile. No source names a fixed version.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 16.2%EPSS, 96th percentile
- Exploitation
- None known2 public exploits
- Fixed in
- No fix listedNo source names one
Description
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-develRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-imapRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-ldapRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-mysqlRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-odbcRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-pgsqlRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
phpRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
Show 82 moreShow less
| Package | Affected | Fixed |
|---|---|---|
php-develRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-imapRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-ldapRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-mysqlRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-odbcRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-pgsqlRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
phpRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-develRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-imapRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-ldapRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-mysqlRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-odbcRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-pgsqlRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
phpRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-develRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-imapRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-ldapRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-mysqlRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-odbcRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
php-pgsqlRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:4.3.2-19.ent | 0:4.3.2-19.ent |
phpRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-develRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-domxmlRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-gdRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-imapRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-ldapRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-mbstringRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-mysqlRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-ncursesRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-odbcRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-pearRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-pgsqlRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-snmpRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-xmlrpcRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
phpRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-develRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-domxmlRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-gdRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-imapRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-ldapRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-mbstringRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-mysqlRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-ncursesRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-odbcRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-pearRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-pgsqlRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-snmpRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-xmlrpcRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
phpRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-develRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-domxmlRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-gdRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-imapRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-ldapRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-mbstringRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-mysqlRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-ncursesRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-odbcRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-pearRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-pgsqlRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-snmpRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-xmlrpcRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
phpRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-develRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-domxmlRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-gdRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-imapRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-ldapRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-mbstringRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-mysqlRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-ncursesRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-odbcRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-pearRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-pgsqlRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-snmpRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
php-xmlrpcRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:4.3.9-3.2 | 0:4.3.9-3.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PHP 3/4/5 - Multiple Local/Remote Vulnerabilities (1) | 2004-12-15 |
| Exploit-DB | PHP 3/4/5 - Multiple Local/Remote Vulnerabilities (2) | 2004-12-15 |
What each source reports
NVD Score used
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
- Record
CVE-2004-1018- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
- Record
CVE-2004-1018- Updated
- 2026-11-02
EUVDEUVD-2004-1016No score
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
- Record
EUVD-2004-1016- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qgcx-fh28-73fmNo score
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode...
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
- Record
GHSA-qgcx-fh28-73fm- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
redhat.com/support/errata/RHSA-2005-032.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10949
mandriva.com/security/advisories?name=MDKSA-2005:072
php.net/release_4_3_10.php
osvdb.org/12411
Show 43 moreShow less
hardened-php.net/advisories/012004.txt
exchange.xforce.ibmcloud.com/vulnerabilities/18515
bugzilla.fedora.us/show_bug.cgi?id=2344
securityfocus.com/archive/1/384920
marc.info?l=bugtraq&m=110314318531298&w=2
ubuntu.com/usn/usn-99-1
nvd.nist.gov/vuln/detail/CVE-2004-1018
github.com/advisories/GHSA-qgcx-fh28-73fm
access.redhat.com/errata/RHSA-2004:687
bugzilla.redhat.com/show_bug.cgi?id=131412
security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_687.json
cve.org/CVERecord?id=CVE-2004-0958