PT-2017-13968 · Sqlite+1 · Sqlite+1
Smallc
·
Published
2017-10-12
·
Updated
2018-03-26
·
CVE-2017-15286
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
SQLite version 3.20.1
Description
The issue arises from a NULL pointer dereference in the tableColumnList function within shell.c. This occurs because the software fails to account for specific cases where
sqlite3 step(pStmt)==SQLITE ROW is false, resulting in a data structure never being initialized.Recommendations
For SQLite version 3.20.1, consider disabling the tableColumnList function in shell.c as a temporary workaround until a patch is available. Restrict access to the
sqlite3 step function to minimize the risk of exploitation. Avoid using the pStmt variable in the affected code path until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Sqlite