CVE-2021-21704

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125 CWE-190 CWE-787

Affected software

Vendor	Product	Versions
PHP Group	PHP	>= 7.3.x, < 7.3.29; >= 7.4.x, < 7.4.21; >= 8.0.X, < 8.0.8

References

https://bugs.php.net/bug.php?id=76448Exploit, Issue Tracking, Patch, Vendor Advisory
https://bugs.php.net/bug.php?id=76449Exploit, Issue Tracking, Patch, Vendor Advisory
https://bugs.php.net/bug.php?id=76450Exploit, Issue Tracking, Patch, Vendor Advisory
https://bugs.php.net/bug.php?id=76452Exploit, Issue Tracking, Patch, Vendor Advisory
https://security.gentoo.org/glsa/202209-20Third Party Advisory
https://security.netapp.com/advisory/ntap-20211029-0006/Third Party Advisory
https://bugs.php.net/bug.php?id=76448Exploit, Issue Tracking, Patch, Vendor Advisory
https://bugs.php.net/bug.php?id=76449Exploit, Issue Tracking, Patch, Vendor Advisory
https://bugs.php.net/bug.php?id=76450Exploit, Issue Tracking, Patch, Vendor Advisory
https://bugs.php.net/bug.php?id=76452Exploit, Issue Tracking, Patch, Vendor Advisory
https://security.gentoo.org/glsa/202209-20Third Party Advisory
https://security.netapp.com/advisory/ntap-20211029-0006/Third Party Advisory

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217055.3In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() funct CVE-2021-217066.5In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may b CVE-2021-217075.3In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), UR CVE-2021-217089.8In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter CVE-2021-21714.4Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.33 CVE-2021-21726.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prio CVE-2021-217224.4A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulne CVE-2021-217237.5Some ZTE products have a DoS vulnerability. Due to the improper handling of memory release in some specific scenarios, a remote attacker can CVE-2021-217244.4A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scenarios, a local attack CVE-2021-217255.7A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in othe CVE-2021-217262.3Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some pa CVE-2021-217277.5A ZTE product has a DoS vulnerability. A remote attacker can amplify traffic by sending carefully constructed IPv6 packets to the affected d