CVE-2018-19395: Null Pointer Dereference
ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and comsafearrayproxy return NULL in compropertiesget in ext/comdotnet/comhandlers.c, as demonstrated by a serialize call on COM("WScript.Shell").
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19395?
CVE-2018-19395 is a medium severity vulnerability that can lead to denial of service due to NULL pointer dereference.
How do I fix CVE-2018-19395?
To fix CVE-2018-19395, upgrade PHP to version 7.2 or later, as versions prior to 7.1.24 are affected.
Which versions of PHP are affected by CVE-2018-19395?
CVE-2018-19395 affects PHP versions from 5.0.0 up to and including 7.1.24.
What types of attacks can CVE-2018-19395 facilitate?
CVE-2018-19395 can facilitate denial of service attacks by causing an application crash.
Is CVE-2018-19395 specific to any operating system?
Yes, CVE-2018-19395 specifically affects PHP running on Windows.