PT-2020-1264 · Sqlite+9 · Sqlite+9
Published
2020-06-15
·
Updated
2024-03-06
·
CVE-2020-15358
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
SQLite versions prior to 3.32.3
Description
The issue is related to a heap overflow in SQLite due to the misuse of transitive properties for constant propagation, which can lead to local information disclosure. This is caused by a missing bounds check in the sqlite3Select function of select.c, allowing for an out-of-bounds write. The vulnerability can be exploited to gain unauthorized access to protected information.
Recommendations
For versions prior to 3.32.3, update to version 3.32.3 or later to resolve the issue.
As a temporary workaround, consider restricting access to sensitive data until the update can be applied.
Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Linuxmint
Apple Macos
Red Hat
Rocky Linux
Sqlite
Suse
Ubuntu