NULL pointer dereference in PHP - CVE-2014-0236
Published: February 13, 2023 / Updated: June 8, 2025
Vulnerability identifier: #VU110274
CSH Severity: Medium
CVSSv4.0:
CVE-ID: CVE-2014-0236
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
PHP
PHP
Software vendor:
PHP Group
PHP Group
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.
Remediation
Install update from vendor's website.