CVE-2004-1064

The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915Broken Link
• http://www.gentoo.org/security/en/glsa/glsa-200412-14.xmlThird Party Advisory
• http://www.hardened-php.net/advisories/012004.txtThird Party Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2004:151Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2005:072Third Party Advisory
• http://www.php.net/release_4_3_10.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/advisories/9028Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/384545Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/11964Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18512Third Party Advisory, VDB Entry
• https://www.ubuntu.com/usn/usn-99-1/Third Party Advisory
• https://www.ubuntu.com/usn/usn-99-2/Third Party Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915Broken Link
• http://www.gentoo.org/security/en/glsa/glsa-200412-14.xmlThird Party Advisory
• http://www.hardened-php.net/advisories/012004.txtThird Party Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2004:151Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2005:072Third Party Advisory
• http://www.php.net/release_4_3_10.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/advisories/9028Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/384545Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/11964Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18512Third Party Advisory, VDB Entry
• https://www.ubuntu.com/usn/usn-99-1/Third Party Advisory
• https://www.ubuntu.com/usn/usn-99-2/Third Party Advisory

Published

Jan 10, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-1058Race condition in Linux kernel 2.6 allows local users to rea…
• CVE-2004-1059Multiple cross-site scripting (XSS) vulnerabilities in mnoGo…
• CVE-2004-1060Multiple TCP/IP and ICMP implementations, when using Path MT…
• CVE-2004-1061Cross-site scripting (XSS) vulnerability in Bugzilla before …
• CVE-2004-1062Multiple cross-site scripting (XSS) vulnerabilities in ViewC…
• CVE-2004-1063PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe…
• CVE-2004-1065Buffer overflow in the exif_read_data function in PHP before…
• CVE-2004-1066The cmdline pseudofiles in (1) procfs on FreeBSD 4.8 through…
• CVE-2004-1067Off-by-one error in the mysasl_canon_user function in Cyrus …
• CVE-2004-1068A "missing serialization" error in the unix_dgram_recvmsg fu…
• CVE-2004-1069Race condition in SELinux 2.6.x through 2.6.9 allows local u…
• CVE-2004-1070The load_elf_binary function in the binfmt_elf loader (binfm…