CVE-2012-3450

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 11%

from disclosure to weapon0 days

Published on NVDAug 6

1st PoCAug 2

exploitation probability

11%top 4% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/37566

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00021.html https://bugs.php.net/bug.php?id=61755 https://bugzilla.novell.com/show_bug.cgi?id=769785 http://seclists.org/bugtraq/2012/Jun/60 http://www.debian.org/security/2012/dsa-2527 http://www.mandriva.com/security/advisories?name=MDVSA-2012:108 http://www.openwall.com/lists/oss-security/2012/08/02/3 http://www.openwall.com/lists/oss-security/2012/08/02/7 http://www.php.net/ChangeLog-5.php http://www.ubuntu.com/usn/USN-1569-1