CVE-2016-7412

ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote…

published September 17, 2016

CVSS
—
EPSS
9%
Percentile
95.2
In the wild
Unconfirmed
What it is

ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote MySQL servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted field metadata.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08850 · 95.2th percentile
Published
2016-09-17T21:00Z
EPSS history
Timeline
  • 17 SEP 21:00Z
    ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote…
    cvelistv5