CVE-2003-0166: php
Vulnerability summary
CVE-2003-0166 is a high (CVSS 7.5) vulnerability in php. EPSS estimates a 14.12% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities. 5 public exploits are recorded.
Timeline
- 27-03-2003PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Integer signedness error in emalloc() function for PHP before 4.3.2 allow remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as (1) socket_recv, (2) socket_recvfrom, and possibly other functions.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
14.12%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 14.12% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
5 foundExploit Reference (securityfocus.com)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
PHP 4.3 - 'socket_iovec_alloc()' Integer Overflow
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Php1 product
- php4.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4 | 4.0.5 | 4.0.6 | 4.0.7 | 4.1.0 | 4.1.1 | 4.1.2 | 4.2.0 | 4.2.1 | 4.2.2 | 4.2.3 | 4.3.0 | 4.3.1
1 vendor · 1 product