CVE-2021-21704
Assigner: php
Published: 2021-06-21T00:00:00
State: PUBLISHED
affected: product: PHP
vendor: PHP Group
versions: lessThan: 7.3.29
status: affected
version: 7.3.x
versionType: custom
lessThan: 7.4.21
status: affected
version: 7.4.x
versionType: custom
lessThan: 8.0.8
status: affected
version: 8.0.X
versionType: custom
credits: value: reported by trichimtrich at gmail dot com
datePublic: 2021-06-21T00:00:00
descriptions: value: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
problemTypes: descriptions: cweId: CWE-125
description: CWE-125 Out-of-bounds Read
type: CWE
descriptions: cweId: CWE-190
description: CWE-190 Integer Overflow or Wraparound
type: CWE
source: defect: https://bugs.php.net/bug.php?id=76448
https://bugs.php.net/bug.php?id=76449
https://bugs.php.net/bug.php?id=76450
https://bugs.php.net/bug.php?id=76452
discovery: EXTERNAL
title: Multiple vulnerabilities in Firebird client extension
x_generator: engine: Vulnogram 0.0.9