← Back to CVEs

CVE-2021-21704

MEDIUM

5.0

Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.

CVE Details

CVSS v3.1 Score5.0

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredNONE

User InteractionREQUIRED

Published10/4/2021

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

netapp:clustered_data_ontapphp:php

Weaknesses (CWE)

CWE-125CWE-190CWE-787

References

https://bugs.php.net/bug.php?id=76448(security@php.net)

https://bugs.php.net/bug.php?id=76449(security@php.net)

https://bugs.php.net/bug.php?id=76450(security@php.net)

https://bugs.php.net/bug.php?id=76452(security@php.net)

https://security.gentoo.org/glsa/202209-20(security@php.net)

https://security.netapp.com/advisory/ntap-20211029-0006/(security@php.net)

https://bugs.php.net/bug.php?id=76448(af854a3a-2127-422b-91ae-364da2661108)

https://bugs.php.net/bug.php?id=76449(af854a3a-2127-422b-91ae-364da2661108)

https://bugs.php.net/bug.php?id=76450(af854a3a-2127-422b-91ae-364da2661108)

https://bugs.php.net/bug.php?id=76452(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202209-20(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20211029-0006/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.