CVE-2012-3450: php
Vulnerability summary
CVE-2012-3450 is a low (CVSS 2.6) vulnerability in php. EPSS estimates a 11.18% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 2.6, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 06-08-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
11.18%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 11.18% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPHP 5.4.3 - PDO Memory Access Violation Denial of Service
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Php1 product
- phpEOL≤ 5.3.13 | 5.3.0 | 5.3.1 | 5.3.2 | 5.3.3 | 5.3.4 | 5.3.5 | 5.3.6 | 5.3.7 | 5.3.8 | 5.3.9 | 5.3.10 | 5.3.11 | 5.3.12 | 5.4.0 | 5.4.1 | 5.4.2 | 5.4.3
1 vendor · 1 product
References
10 links
- www.php.net/ChangeLog-5.phpX Refsource CONFIRM
- bugs.php.net/bug.php?id=61755X Refsource CONFIRM
- bugzilla.novell.com/show_bug.cgi?id=769785X Refsource CONFIRM