CVE-2014-0236 Null dereference in n/a
Remote attackers can crash the application via a crafted CDF file due to a NULL pointer dereference in the PHP Fileinfo component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0236?
CVE-2014-0236 is a high-severity vulnerability in Php Php, published on 16 May 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.
Which versions are affected by CVE-2014-0236?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2014-0236?
Upgrade to a fixed version.
Is CVE-2014-0236 being exploited?
There is no known exploitation of CVE-2014-0236 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as DEBIAN-CVE-2014-0236, GHSA-v7cp-96gw-54m4.