CVE-2021-21704
Published: 2 July 2021
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Released
(5.5.9+dfsg-1ubuntu4.29+esm14)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
php7.0 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(7.0.33-0ubuntu0.16.04.16+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
|
php7.2 Launchpad, Ubuntu, Debian |
bionic |
Released
(7.2.24-0ubuntu0.18.04.8)
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
php7.4 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Released
(7.4.3-4ubuntu2.5)
|
|
| groovy |
Released
(7.4.9-1ubuntu1.2)
|
|
| hirsute |
Released
(7.4.16-1ubuntu2.1)
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(7.4.21)
|
|
| xenial |
Does not exist
|
|
|
Patches: upstream: https://github.com/php/php-src/commit/286162e9b03071c4308e7e92597bca4239f49d89 upstream: https://github.com/php/php-src/commit/bcbf8aa0c96d8d9e81ec3428232485555fae0b37 upstream: https://github.com/php/php-src/commit/08da7c73726f7b86b67d6f0ff87c73c585a7834a upstream: https://github.com/php/php-src/commit/67afa32541ebc4abbf633cb1e7e879b2fbb616ad |
||
|
php8.0 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Released
(8.0.8-1)
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(8.0.8)
|
|
| xenial |
Does not exist
|
|
|
php8.1 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Not vulnerable
(8.1.0-1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.9 |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |