Vulnerability in PHP
CVE-2012-3450
pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 2.6 (Low). Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.112 (95.8th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.112 · newest: 0.112 · change: 0.000
Affected products
- PHP — versions 5.3.0, 5.3.1, 5.3.2
Public proof-of-concept exploits
References
- www.openwall.com/lists/oss-security/2012/08/02/7 (mailing-list)
- www.debian.org/security/2012/dsa-2527 (vendor-advisory)
- www.php.net/ChangeLog-5.php
- www.openwall.com/lists/oss-security/2012/08/02/3 (mailing-list)
- bugs.php.net/bug.php
- seclists.org/bugtraq/2012/Jun/60 (mailing-list)
- www.mandriva.com/security/advisories (vendor-advisory)
- www.ubuntu.com/usn/USN-1569-1 (vendor-advisory)
- bugzilla.novell.com/show_bug.cgi
- lists.opensuse.org/opensuse-security-announce/2012-08/msg00021.html (vendor-advisory)
Frequently asked questions
- What is CVE-2012-3450?
- CVE-2012-3450 is a vulnerability in PHP. Published 2012-08-06.
- Is CVE-2012-3450 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.