PT-2007-3234 · Sqlite+1 · Sqlite+1

Publicado 2007-04-05 · Atualizado 2018-10-30 · CVE-2007-1888

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: SQLite 2 PHP versions 4.x through 5.x

Description: A buffer overflow issue in the sqlite decode binary function allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter. The SQLite developer has argued that this issue could be due to a misuse of the sqlite decode binary() API.

Recommendations: For SQLite 2, consider disabling the sqlite decode binary() function until a patch is available. For PHP versions 4.x through 5.x, restrict the use of the sqlite decode binary() function in the SQLite API to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-1888

Produtos afetados

Php

Sqlite

Referências · 12

• http://attrition.org/pipermail/vim/2007-April/001540.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1888 · Nota
• http://osvdb.org/39177 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38518 · Nota
• http://ubuntu.com/usn/usn-455-1 · Aviso do Fabricante
• http://sqlite.org/cvstrac/rlog?f=sqlite/src/encode.c · Nota
• http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:091 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2007:091 · Aviso do Fabricante
• http://php-security.org/MOPB/MOPB-41-2007.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-1888 · Nota de Segurança
• http://secunia.com/advisories/25057 · Nota
• https://osv.dev/vulnerability/CVE-2007-1888 · Aviso do Fabricante