CVE-2018-14884: Null Pointer Dereference

Q: What is the severity of CVE-2018-14884?

CVE-2018-14884 has a medium severity rating due to the potential for a segmentation fault leading to application crashes.

Q: How do I fix CVE-2018-14884?

To fix CVE-2018-14884, upgrade to PHP version 7.0.27, 7.1.13, or 7.2.1 or later.

Q: What versions of PHP are affected by CVE-2018-14884?

PHP versions prior to 7.0.27, 7.1.13, and 7.2.1 are affected by CVE-2018-14884.

Q: What causes the vulnerability in CVE-2018-14884?

The vulnerability in CVE-2018-14884 is due to improper parsing of HTTP response headers that can result in a NULL value being mishandled.

Q: Is CVE-2018-14884 a remote exploit vulnerability?

CVE-2018-14884 is not considered a remote exploit vulnerability as it leads to local application crashes instead.

Published Nov 17, 2017

Updated

An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because httpheadervalue in ext/standard/httpfopenwrapper.c can be a NULL value that is mishandled in an atoi call.

Other sources

Fixed bug (Inappropriately parsing HTTP response leads to PHP segment fault). (CVE-2018-14884)

— PHP

Affected Software

10 affected componentsFixes available

redhat/rh-php71-php<0:7.1.30-1.el7

0:7.1.30-1.el7

redhat/php<7.0.27

7.0.27

redhat/php<7.1.13

7.1.13

redhat/php<7.2.1

7.2.1

PHP PHP>=7.0.0<7.0.27

PHP PHP>=7.1.0<7.1.13

PHP PHP>=7.2.0<7.2.1

NetApp Storage Automation Store

PHP PHP<7.0.27

7.0.27

alpine/php7<7.1.29-r0

7.1.29-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/rh-php71-php to a version that resolves this vulnerability.
Fixed in 0:7.1.30-1.el7
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 7.0.27
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 7.1.13
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 7.2.1
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 7.0.27
Upgrade
Upgrade alpine/php7 to a version that resolves this vulnerability.
Fixed in 7.1.29-r0
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 7.1.13
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 7.2.1

Event History

Nov 17, 2017

CVE Published

12:00 AM

Aug 3, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

Description

Data Sourced

via OSV·01:29 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

RHSA-2019:2519

Frequently Asked Questions

What is the severity of CVE-2018-14884?