CVE-2003-0166
HIGH
7.5
CVSS 2.0
Description
Integer signedness error in emalloc() function for PHP before 4.3.2 allow remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as (1) socket_recv, (2) socket_recvfrom, and possibly other functions.
Affected products and versions
- PHP versions 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1
References
- distro.conectiva.com.br http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000691
- marc.info http://marc.info/?l=bugtraq&m=104869828526885&w=2
- marc.info http://marc.info/?l=bugtraq&m=104878100719467&w=2
- marc.info http://marc.info/?l=bugtraq&m=104931415307111&w=2
- www.securityfocus.com http://www.securityfocus.com/bid/7197 Exploit, Vendor Advisory
- www.securityfocus.com http://www.securityfocus.com/bid/7198 Exploit, Vendor Advisory
- nvd.nist.gov Official NVD record