CVE-2004-0594: avaya converged_communications_server

Vulnerability summary

CVE-2004-0594 is a medium (CVSS 5.1) vulnerability in avaya converged_communications_server. EPSS estimates a 54.86% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-07-2004
   PublishedVulnerability first disclosed.
2. 08-08-2024
   Last modifiedVulnerability information updated.

Description

The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.

• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.