CVEvulnerability
CVE-2004-1064
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2005-01-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
Affected configurations
• php php (>= 4.0.0 <= 4.3.9)
• php php (>= 5.0.0 <= 5.0.2)
• canonical ubuntu linux 4.10
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915 Broken Link
- http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml Third Party Advisory
- http://www.hardened-php.net/advisories/012004.txt Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:151 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:072 Third Party Advisory
- http://www.php.net/release_4_3_10.php Release Notes, Vendor Advisory
- http://www.securityfocus.com/advisories/9028 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/384545 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/11964 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18512 Third Party Advisory, VDB Entry
- https://www.ubuntu.com/usn/usn-99-1/ Third Party Advisory
- https://www.ubuntu.com/usn/usn-99-2/ Third Party Advisory
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915 Broken Link
- http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml Third Party Advisory
- http://www.hardened-php.net/advisories/012004.txt Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:151 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:072 Third Party Advisory
- http://www.php.net/release_4_3_10.php Release Notes, Vendor Advisory
- http://www.securityfocus.com/advisories/9028 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/384545 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/11964 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18512 Third Party Advisory, VDB Entry
- https://www.ubuntu.com/usn/usn-99-1/ Third Party Advisory
- https://www.ubuntu.com/usn/usn-99-2/ Third Party Advisory