PT-2015-6222 · Sqlite+5 · Sqlite+5
Michal Zalewski
·
Publicado
2015-04-24
·
Atualizado
2024-06-15
·
CVE-2015-3416
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
SQLite versions prior to 3.8.9
Description
The issue concerns the sqlite3VXPrintf function in printf.c, which does not properly handle precision and width values during floating-point conversions. This can be exploited by context-dependent attackers to cause a denial of service, specifically an integer overflow and stack-based buffer overflow, or possibly have other unspecified impacts. The attack can be carried out via large integers in a crafted printf function call in a SELECT statement.
Recommendations
For versions prior to 3.8.9, update to version 3.8.9 or later to resolve the issue.
Correção
DoS
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Sqlite
Ubuntu
Itunes