PT-2022-5232 · Sqlite+12 · Sqlite+12
Andreas Kellas
·
Published
2022-07-22
·
Updated
2026-02-23
·
CVE-2022-35737
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
SQLite versions 1.0.12 through 3.39.x before 3.39.2
Description
The issue is related to an array-bounds overflow in the SQLite API library, which can be triggered by a remote attacker using a long sequence of string data processed by the
printf function with a format string containing %Q, %q, or %w types. This can lead to a denial of service or the execution of arbitrary code. The vulnerability is associated with the use of billions of bytes in a string argument to a C API.Recommendations
For SQLite versions 1.0.12 through 3.39.x before 3.39.2, update to version 3.39.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
printf function with format strings containing %Q, %q, or %w types to minimize the risk of exploitation. Avoid using large string inputs in the printf function until the issue is resolved.Exploit
Fix
RCE
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Sqlite
Suse
Ubuntu
Windows