CVE-2014-0236

High

Published: 16/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

PHP versions before 5.6.0 contain a vulnerability in the Fileinfo component that allows remote attackers to cause application crashes via a NULL pointer dereference. This issue occurs in CDF files with a zero root_storage value.

Risk Assessment

This vulnerability may lead to denial of service, affecting application availability and disrupting services for users.

Recommendation

It is recommended to upgrade PHP to version 5.6.0 or later to mitigate this vulnerability and minimize the risk of application crashes.

Other vulnerabilities in Fileinfo component in PHP

CVE-2014-9426High
The apprentice_load function in the Fileinfo component in PHP through version 5.6.4 attempts to perform a free operation on a stack-based character array, which may lead to application crashes or memory corruption.

Original NVD description (English source)

file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.