CVE-2018-14884 Null dereference in n/a
A null pointer dereference in PHP's HTTP response parsing causes a segmentation fault, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14884?
CVE-2018-14884 is a high-severity vulnerability in Netapp Storage Automation Store, published on 3 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.
Weakness: CWE-476
Which versions are affected by CVE-2018-14884?
It affects 2 products.
Products include Netapp Storage Automation Store, Php Php.
How do I fix CVE-2018-14884?
Upgrade to a fixed version.
Is CVE-2018-14884 being exploited?
There is no known exploitation of CVE-2018-14884 in the wild and no public exploit code.
Other vulnerabilities in Netapp Storage Automation Store
Sources
Also known as GHSA-4f5w-5x35-7vgh.