CVE-2012-3450

The record

pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.

Affected packages

Related vulnerabilities

• CVE-2015-6834 Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and… Also affects php5
• CVE-2015-5589 The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x… Also affects php5
• CVE-2015-4643 Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x… Also affects php5
• CVE-2015-4602 The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before… Also affects php5
• CVE-2015-4600 The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before… Also affects php5
• CVE-2015-4599 The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before… Also affects php5
• CVE-2015-3411 PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that… Also affects php5
• CVE-2015-6836 The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before… Also affects php5