CVE Vulnerabilities

CVE-2004-1020

Published: Jan 10, 2005 | Modified: Jul 11, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

Affected Software

Name Vendor Start Version End Version
Php Php 4.3.6 4.3.6
Php Php 4.3.7 4.3.7
Php Php 4.3.8 4.3.8
Php Php 4.3.9 4.3.9
Php Php 5.0 5.0
Php Php 5.0 5.0
Php Php 5.0 5.0
Php Php 5.0.0 5.0.0
Php Php 5.0.1 5.0.1
Php Php 5.0.2 5.0.2
Php4 Ubuntu dapper *
Php4 Ubuntu edgy *
Php5 Ubuntu dapper *
Php5 Ubuntu devel *
Php5 Ubuntu edgy *
Php5 Ubuntu feisty *

References