Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2012-3450

Date: August 6, 2012

pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.

Severity Score

Related Resources (13)

http://www.openwall.com/lists/oss-security/2012/08/02/3
https://bugs.php.net/bug.php?id=61755
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00021.html
https://nvd.nist.gov/vuln/detail/CVE-2012-3450
https://people.canonical.com/~ubuntu-security/cve/CVE-2012-3450
http://www.php.net/ChangeLog-5.php
https://bugzilla.novell.com/show_bug.cgi?id=769785
http://www.openwall.com/lists/oss-security/2012/08/02/7
http://www.debian.org/security/2012/dsa-2527
http://www.ubuntu.com/usn/USN-1569-1
http://seclists.org/bugtraq/2012/Jun/60
http://www.mandriva.com/security/advisories?name=MDVSA-2012:108
https://www.mend.io/vulnerability-database/CVE-2012-3450

Severity Score

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): HIGH
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us