PT-2017-13968 · Sqlite+1 · Sqlite+1
Smallc
·
Publicado
2017-10-12
·
Atualizado
2018-03-26
·
CVE-2017-15286
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
SQLite version 3.20.1
Description
The issue arises from a NULL pointer dereference in the tableColumnList function within shell.c. This occurs because the software fails to account for specific cases where
sqlite3 step(pStmt)==SQLITE ROW is false, resulting in a data structure never being initialized.Recommendations
For SQLite version 3.20.1, consider disabling the tableColumnList function in shell.c as a temporary workaround until a patch is available. Restrict access to the
sqlite3 step function to minimize the risk of exploitation. Avoid using the pStmt variable in the affected code path until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
NULL Pointer Dereference
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Sqlite