CVE-2021-21704
5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Summary
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| PHP Group | PHP | 7.3.x < 7.3.29 | affected |
| PHP Group | PHP | 7.4.x < 7.4.21 | affected |
| PHP Group | PHP | 8.0.X < 8.0.8 | affected |
Weaknesses
- CWE-125: CWE-125 Out-of-bounds Read
- CWE-190: CWE-190 Integer Overflow or Wraparound
ADP Enrichment
CVE Program Container
Additional References
- https://bugs.php.net/bug.php?id=76448
- https://bugs.php.net/bug.php?id=76449
- https://bugs.php.net/bug.php?id=76450
- https://bugs.php.net/bug.php?id=76452
- https://security.netapp.com/advisory/ntap-20211029-0006/
- https://security.gentoo.org/glsa/202209-20
References
- https://bugs.php.net/bug.php?id=76448
- https://bugs.php.net/bug.php?id=76449
- https://bugs.php.net/bug.php?id=76450
- https://bugs.php.net/bug.php?id=76452
- https://security.netapp.com/advisory/ntap-20211029-0006/
- https://security.gentoo.org/glsa/202209-20
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.