CVE-2010-3063: PHP

Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days.

The php_mysqlnd_read_error_from_line function in the Mysqlnd extension in PHP 5.3 through 5.3.2 does not properly calculate a buffer length, which allows context-dependent attackers to trigger a heap-based buffer overflow via crafted inputs that cause a negative length value to be used.

Affected products

• PHP PHP: version 5.3.0 only; version 5.3.1 only; version 5.3.2 only

Published 2010-08-20. Last modified 2026-06-16.