CVE-2004-1019: Openpkg

High severity, CVSS 10.0. EPSS: 8% chance of exploitation in the next 30 days.

The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results.

Affected products

• Openpkg Openpkg: version 2.1 only; version 2.2 only; version current only
• PHP PHP: version 3.0 only; version 3.0.1 only; version 3.0.2 only; version 3.0.3 only; version 3.0.4 only; version 3.0.5 only; …
• Trustix Secure Linux: version 2.0 only; version 2.1 only; version 2.2 only
• Ubuntu Ubuntu Linux: version 4.1 only

Published 2005-01-10. Last modified 2026-06-16.