CVE-2018-19935: Null Pointer Dereference

Q: What is the severity of CVE-2018-19935?

CVE-2018-19935 has been classified as a denial of service vulnerability that can result in an application crash.

Q: How do I fix CVE-2018-19935?

To fix CVE-2018-19935, upgrade to PHP version 7.3.0 or later.

Q: Which versions of PHP are affected by CVE-2018-19935?

CVE-2018-19935 affects PHP versions prior to 7.3.0, including 5.x and 7.x versions up to 7.2.14.

Q: What does CVE-2018-19935 exploit?

CVE-2018-19935 exploits the imap_mail function by allowing a denial of service through a NULL pointer dereference.

Q: Is CVE-2018-19935 a local or remote vulnerability?

CVE-2018-19935 is a remote vulnerability that allows attackers to crash the application from a remote location.

Published Dec 7, 2018

Updated

ext/imap/phpimap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imapmail function.

Affected Software

11 affected componentsFixes available

PHP PHP>=5.6.0<5.6.39

PHP PHP>=7.0.0<7.0.33

PHP PHP>=7.1.0<7.1.26

PHP PHP>=7.2.0<7.2.14

Debian Debian Linux=8.0

Debian Debian Linux=9.0

debian/php5

debian/php7.0

debian/php7.2

alpine/php5<5.6.39-r0

5.6.39-r0

alpine/php7<7.1.29-r0

7.1.29-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/php5 to a version that resolves this vulnerability.
Fixed in 5.6.39-r0
Upgrade
Upgrade alpine/php7 to a version that resolves this vulnerability.
Fixed in 7.1.29-r0

Event History

Dec 7, 2018

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

Description

Data Sourced

via OSV·09:29 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-4353

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1608-1

Frequently Asked Questions

What is the severity of CVE-2018-19935?