PT-2018-3489 · Sqlite+5 · Sqlite+5

Even Rouault + 1 · Published 2018-03-16 · Updated 2024-06-15 · CVE-2018-8740

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: SQLite versions prior to 3.22.0

Description: The issue is related to a NULL pointer dereference in the SQLite database management system. It occurs when a database's schema is corrupted using a CREATE TABLE AS statement, specifically involving the build.c and prepare.c components. This could potentially allow a remote attacker to cause a denial of service.

Recommendations: For SQLite versions prior to 3.22.0, update to version 3.22.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the CREATE TABLE AS statement until a patch is available.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-2285

BDU:2020-02560

CVE-2018-8740

DLA-1633-1

DLA-2340-1

DLA-3431-1

MGASA-2018-0181

MGASA-2023-0208

OPENSUSE-SU-2019_1426-1

OPENSUSE-SU-2024:11400-1

SUSE-SU-2019:1208-1

SUSE-SU-2019:1522-1

SUSE-SU-2021:3215-1

USN-4205-1

USN-4394-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Sqlite

Suse

Ubuntu

References · 195

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10989 · Security Note
• https://sqlite.org/cgi/src/timeline?r=corrupt-schema · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-16168 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05062 · Security Note
• https://advisories.mageia.org/MGASA-2023-0208.html · Security Note
• https://bdu.fstec.ru/vul/2020-00864 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13434 · Security Note
• https://osv.dev/vulnerability/DLA-2340-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8740 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11655 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8740 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01425 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/654733 · Security Note
• https://ubuntu.com/security/CVE-2019-19603 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4205-1 · Vendor Advisory