title: Multiple vulnerabilities in Firebird client extension
description: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
problem types: CWE-125 Out-of-bounds Read
affected:
{
product: PHP
vendor: PHP Group
versions:
lessThan: 7.3.29, status: affected, version: 7.3.x, versionType: custom
lessThan: 7.4.21, status: affected, version: 7.4.x, versionType: custom
lessThan: 8.0.8, status: affected, version: 8.0.X, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
]