CVE-2004-1020

• BUGTRAQ:20041216 PHP Input Validation Vulnerabilities
• URL:http://www.securityfocus.com/archive/1/384663
• CONFIRM:http://www.php.net/release_4_3_10.php
• CONECTIVA:CLA-2005:915
• URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915
• GENTOO:GLSA-200412-14
• URL:http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml
• HP:HPSBMA01212
• URL:http://www.securityfocus.com/advisories/9028
• MANDRAKE:MDKSA-2004:151
• URL:http://www.mandriva.com/security/advisories?name=MDKSA-2004:151
• BID:11981
• URL:http://www.securityfocus.com/bid/11981
• XF:php-addslashes-view-files(18516)
• URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/18516

 Christey> There is active disagreement regarding whether this satisfies the
   criteria for inclusion in CVE, because the attack vectors require
   function parameters that are typically controlled only by the
   application developer, not an external attacker.  This would mean that
   only the PHP application owner could exploit it.
   
   Since the application developer presumably already has acccess
   to the underlying file system, directory traversal attacks provide no
   additional access to the application owner.  Therefore, this candidate
   would only be valid if there are cases in which the attacker can
   inject a null character into a string that is processed by addslashes.