CVE-2004-0594: Avaya Converged Communications Server

Medium severity, CVSS 5.1. EPSS: 54.9% chance of exploitation in the next 30 days.

The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.

Affected products

• Avaya Converged Communications Server: version 2.0 only
• Debian Debian Linux: version 3.0 only
• HP HP-Ux: version b.11.00 only; version b.11.11 only; version b.11.22 only; version b.11.23 only
• Openpkg Openpkg: version 2.0 only; version 2.1 only
• PHP PHP: from 4.0, before 4.3.7 (fixed in 4.3.7); version 5.0.0 only
• Trustix Secure Linux: version 1.5 only; version 2.0 only; version 2.1 only

Published 2004-07-27. Last modified 2026-06-16.