Description (CNA)
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| PHP Group / PHP | affected 8.2.* before 8.2.34; affected 8.3.* before 8.3.35; affected 8.4.* before 8.4.26; affected 8.5.* before 8.5.11 |
CWE
CWE-122
References
ADP enrichment
No English description supplied.
No references supplied.