PT-2007-3234 · Sqlite+1 · Sqlite+1

Published 2007-04-05 · Updated 2018-10-30 · CVE-2007-1888

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: SQLite 2 PHP versions 4.x through 5.x

Description: A buffer overflow issue in the sqlite decode binary function allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter. The SQLite developer has argued that this issue could be due to a misuse of the sqlite decode binary() API.

Recommendations: For SQLite 2, consider disabling the sqlite decode binary() function until a patch is available. For PHP versions 4.x through 5.x, restrict the use of the sqlite decode binary() function in the SQLite API to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-1888

Affected Products

Php

Sqlite

References · 12

• http://ubuntu.com/usn/usn-455-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:091 · Vendor Advisory
• http://php-security.org/MOPB/MOPB-41-2007.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1888 · Security Note
• https://osv.dev/vulnerability/CVE-2007-1888 · Vendor Advisory
• http://attrition.org/pipermail/vim/2007-April/001540.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1888 · Note
• http://osvdb.org/39177 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38518 · Note
• http://sqlite.org/cvstrac/rlog?f=sqlite/src/encode.c · Note
• http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:091 · Note
• http://secunia.com/advisories/25057 · Note