CVE-2018-19935

Vulnerability

In PHP versions 5.x and 7.x before 7.3.0, the imap_mail() function in ext/imap/php_imap.c contains a NULL pointer dereference vulnerability. When the message parameter is an empty string or not provided, the internal function _php_imap_mail does not validate the input before passing it to fprintf, leading to a segmentation fault [1]. The bug is triggered in PHP 7.2.11 and earlier versions [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted request to a PHP application that calls imap_mail() with an empty string as the message argument. No authentication is required if the application exposes this function to untrusted input. The attacker only needs to trigger the vulnerable code path, resulting in immediate denial of service [1].

Impact

Successful exploitation causes a NULL pointer dereference, leading to an application crash (denial of service). The impact is limited to availability; no data confidentiality or integrity is compromised. The crash occurs in the context of the PHP process [1].

Mitigation

The fix is included in PHP version 7.3.0, released on December 6, 2018 [1]. Users should upgrade to PHP 7.3.0 or later. For PHP 5.x and 7.0–7.2 branches, no official patches have been backported; upgrading to 7.3.0 is recommended. There is no workaround if the imap_mail() function must be used with untrusted input.