CVE-2012-3450

2012-08-0616:55:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

php

pdo extension

cve-2012-3450

security vulnerability

remote attack

denial of service

6.3 Medium

AI Score

Confidence

Low

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:N/I:N/A:P

0.062 Low

EPSS

Percentile

93.5%

JSON

pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.

CPENameOperatorVersion
php:phpphpeq5.3.10
php:phpphpeq5.3.6
php:phpphpeq5.3.9
php:phpphpeq5.3.1
php:phpphpeq5.3.8
php:phpphple5.3.13
php:phpphpeq5.4.2
php:phpphpeq5.3.12
php:phpphpeq5.3.0
php:phpphpeq5.3.3

CPE	Name	Operator	Version
php:php	php	eq	5.3.10
php:php	php	eq	5.3.6
php:php	php	eq	5.3.9
php:php	php	eq	5.3.1
php:php	php	eq	5.3.8
php:php	php	le	5.3.13
php:php	php	eq	5.4.2
php:php	php	eq	5.3.12
php:php	php	eq	5.3.0
php:php	php	eq	5.3.3