PHP up to 7.0.26/7.1.12/7.2.0 http_fopen_wrapper.c HTTP Response null pointer dereference

Summaryinfo

A vulnerability identified as critical has been detected in PHP up to 7.0.26/7.1.12/7.2.0. This impacts an unknown function of the file ext/standard/http_fopen_wrapper.c. This manipulation as part of HTTP Response causes null pointer dereference. This vulnerability appears as CVE-2018-14884. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in PHP up to 7.0.26/7.1.12/7.2.0 (Programming Language Software) and classified as critical. Affected by this vulnerability is some unknown functionality of the file ext/standard/http_fopen_wrapper.c. The manipulation as part of a HTTP Response leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.

The bug was discovered 07/19/2018. The weakness was presented 08/03/2018 (Website). The advisory is shared at php.net. This vulnerability is known as CVE-2018-14884 since 08/03/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 15 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 7.0.27, 7.1.12 or 7.2.1 eliminates this vulnerability.

See VDB-80326, VDB-80327, VDB-83183 and VDB-83184 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Programming Language Software

Name

• PHP

Version

• 7.0
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 7.0.13
• 7.0.14
• 7.0.15
• 7.0.16
• 7.0.17
• 7.0.18
• 7.0.19
• 7.0.20
• 7.0.21
• 7.0.22
• 7.0.23
• 7.0.24
• 7.0.25
• 7.0.26
• 7.1
• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8
• 7.1.9
• 7.1.10
• 7.1.11
• 7.1.12
• 7.2.0

License

• open-source

Website

• Product: https://www.php.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion