CVE catalog
CVE-2004-0594
php3 - several
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 54.86% · Oct 27, 2026
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete. security flaw
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php4 | 3.0 | 4.1.2-7 | fixed |
| Debian | php3 | 3.0 | 3:3.0.18-23.1woody1 | vulnerable |
| Debian | php3 | 3.0 | 3:3.0.18-23.1woody2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | php4 | deb | 3.0 | 4.1.2-7 | Not reported | DSA-531 | Not reported |
| Debian | php3 | deb | 3.0 | 3:3.0.18-23.1woody2 | Not reported | DSA-669-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: