PT-2018-3489 · Sqlite+5 · Sqlite+5

Even Rouault + 1 · Publicado 2018-03-16 · Atualizado 2024-06-15 · CVE-2018-8740

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: SQLite versions prior to 3.22.0

Description: The issue is related to a NULL pointer dereference in the SQLite database management system. It occurs when a database's schema is corrupted using a CREATE TABLE AS statement, specifically involving the build.c and prepare.c components. This could potentially allow a remote attacker to cause a denial of service.

Recommendations: For SQLite versions prior to 3.22.0, update to version 3.22.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the CREATE TABLE AS statement until a patch is available.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2018-2285

BDU:2020-02560

CVE-2018-8740

DLA-1633-1

DLA-2340-1

DLA-3431-1

MGASA-2018-0181

MGASA-2023-0208

OPENSUSE-SU-2019_1426-1

OPENSUSE-SU-2024:11400-1

SUSE-SU-2019:1208-1

SUSE-SU-2019:1522-1

SUSE-SU-2021:3215-1

USN-4205-1

USN-4394-1

Produtos afetados

Alt Linux

Astra Linux

Linuxmint

Sqlite

Suse

Ubuntu

Referências · 195

• https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html · Nota
• https://bugs.mageia.org/show_bug.cgi?id=32018 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10989 · Nota de Segurança
• https://sqlite.org/cgi/src/timeline?r=corrupt-schema · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-16168 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-05062 · Nota de Segurança
• https://suse.com/security/cve/CVE-2020-13632 · Nota
• https://advisories.mageia.org/MGASA-2023-0208.html · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-00864 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13434 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2018-8740 · Nota
• https://mail-archive.com/[e-mail]/msg114383.html · Nota
• https://osv.dev/vulnerability/DLA-2340-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-10989 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8740 · Nota de Segurança