Lucene search

[email protected]CVE-2012-3450

HistoryAug 06, 2012 - 4:55 p.m.

CVE-2012-3450

2012-08-0616:55:05

[email protected]

web.nvd.nist.gov

100

php

pdo extension

cve-2012-3450

security vulnerability

remote attack

denial of service

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:N/I:N/A:P

6.3 Medium

AI Score

Confidence

Low

0.062 Low

EPSS

Percentile

93.6%

JSON

pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.

Affected configurations

NVD

Node

phpphpRange≤5.3.13

phpphpMatch5.3.0

phpphpMatch5.3.1

phpphpMatch5.3.2

phpphpMatch5.3.3

phpphpMatch5.3.4

phpphpMatch5.3.5

phpphpMatch5.3.6

phpphpMatch5.3.7

phpphpMatch5.3.8

phpphpMatch5.3.9

phpphpMatch5.3.10

phpphpMatch5.3.11

phpphpMatch5.3.12

phpphpMatch5.4.0

phpphpMatch5.4.1

phpphpMatch5.4.2

phpphpMatch5.4.3

CPENameOperatorVersion
php:phpphple5.3.13
php:phpphpeq5.3.0
php:phpphpeq5.3.1
php:phpphpeq5.3.2
php:phpphpeq5.3.3
php:phpphpeq5.3.4
php:phpphpeq5.3.5
php:phpphpeq5.3.6
php:phpphpeq5.3.7
php:phpphpeq5.3.8

CPE	Name	Operator	Version
php:php	php	le	5.3.13
php:php	php	eq	5.3.0
php:php	php	eq	5.3.1
php:php	php	eq	5.3.2
php:php	php	eq	5.3.3
php:php	php	eq	5.3.4
php:php	php	eq	5.3.5
php:php	php	eq	5.3.6
php:php	php	eq	5.3.7
php:php	php	eq	5.3.8