Is CVE-2004-1018 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 16%.

What products does CVE-2004-1018 affect?

Tracked products affected include Ubuntu. Check the version you run to see whether it is affected.

How do I fix CVE-2004-1018?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2004-1018

Q: What is CVE-2004-1018?

CVE-2004-1018 is a high-severity software vulnerability with a CVSS score of 10. Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overfl

HIGH severity · CVSS 10

10CVSS HIGH

Summary

Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)16%

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products we track (1)

Ubuntu

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://www.php.net/release_4_3_10.phpAdvisory
http://marc.info/?l=bugtraq&m=110314318531298&w=2Advisory
http://www.hardened-php.net/advisories/012004.txtAdvisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:151Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:072Advisory
http://www.osvdb.org/12411
http://www.redhat.com/support/errata/RHSA-2005-032.htmlAdvisory
http://www.redhat.com/support/errata/RHSA-2005-816.htmlAdvisory