CVE-2021-21704CWE-125CWE-190

Multiple vulnerabilities in Firebird client extension

Medium · published October 4, 2021

CVSS v3.1
5.0
EPSS
2%
Percentile
78.3
In the wild
Unconfirmed
What it is

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01796 · 78.3th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-190 · Integer Overflow or Wraparound
Published
2021-10-04T04:00Z
EPSS history
Timeline
  • 04 OCT 04:00Z
    Multiple vulnerabilities in Firebird client extension
    cvelistv5