Vulnerability in Php
CVE-2012-3450
pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.
EPSS: 0.112 (95.5th percentile) — read the EPSS interpretation.
Affected products
- Php — versions 5.3.0, 5.3.1, 5.3.2
- N/a — versions n/a
Public proof-of-concept exploits
References
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ)
- secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2012-3450?
- CVE-2012-3450 is a vulnerability in Php. Published 2012-08-06.
- Is CVE-2012-3450 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.