PT-2022-5232 · Sqlite+12 · Sqlite+12

Andreas Kellas

·

Published

2022-07-22

·

Updated

2026-02-23

·

CVE-2022-35737

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions SQLite versions 1.0.12 through 3.39.x before 3.39.2
Description The issue is related to an array-bounds overflow in the SQLite API library, which can be triggered by a remote attacker using a long sequence of string data processed by the printf function with a format string containing %Q, %q, or %w types. This can lead to a denial of service or the execution of arbitrary code. The vulnerability is associated with the use of billions of bytes in a string argument to a C API.
Recommendations For SQLite versions 1.0.12 through 3.39.x before 3.39.2, update to version 3.39.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the printf function with format strings containing %Q, %q, or %w types to minimize the risk of exploitation. Avoid using large string inputs in the printf function until the issue is resolved.

Exploit

Fix

RCE

Improper Validation of Array Index

Weakness Enumeration

Related Identifiers

ALSA-2023:0110
ALSA-2023:0339
ALSA-2023_0110
ALSA-2023_0339
ALT-PU-2022-2292
AZL-10467
BDU:2022-06495
BIT-SQLITE-2022-35737
CESA-2023_0110
CVE-2022-35737
ELSA-2023-0110
ELSA-2023-0339
GHSA-JW36-HF63-69R9
MGASA-2022-0273
OESA-2022-1909
OPENSUSE-SU-2022_3307-1
OPENSUSE-SU-2024:12210-1
RHSA-2023:0110
RHSA-2023:0339
RHSA-2023_0110
RHSA-2023_0339
RHSA-2024:0425
RLSA-2023:0110
RLSA-2023:0339
RLSA-2023_0110
RLSA-2023_0339
RUSTSEC-2022-0090
SUSE-SU-2022:3307-1
SUSE-SU-2022:3307-2
SUSE-SU-2022:3401-1
SUSE-SU-2022_3307-1
SUSE-SU-2022_3307-2
SUSE-SU-2022_3401-1
USN-5712-1
USN-5716-1
USN-5716-2

Affected Products

Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Sqlite
Suse
Ubuntu
Windows