blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2021-21704

MEDIUM 5.9 CVSS 3.1
Published
October 4, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-125, CWE-190, CWE-787
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.

Affected products and versions

  • PHP — From 7.3.0 (including) to 7.3.29 (excluding)
  • PHP — From 7.4.0 (including) to 7.4.21 (excluding)
  • PHP — From 8.0.0 (including) to 8.0.8 (excluding)

References

  • bugs.php.net https://bugs.php.net/bug.php?id=76448 Exploit, Issue Tracking, Patch, Vendor Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=76449 Exploit, Issue Tracking, Patch, Vendor Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=76450 Exploit, Issue Tracking, Patch, Vendor Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=76452 Exploit, Issue Tracking, Patch, Vendor Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/202209-20 Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20211029-0006/ Third Party Advisory
  • nvd.nist.gov Official NVD record