PT-2023-8333 · Sqlite+10 · Sqlite+10
Junwha Hong
+2
·
Published
2023-12-25
·
Updated
2025-01-28
·
CVE-2023-7104
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
SQLite versions up to 3.43.0
Description
A critical issue affects the
sessionReadRecord function of the file ext/session/sqlite3session.c, leading to a heap-based buffer overflow. This can be exploited by a remote attacker to impact confidentiality, integrity, and availability. The manipulation involves improper bounds checking, allowing a specially crafted request to overflow a buffer and potentially execute arbitrary code on the system.Recommendations
For SQLite versions up to 3.43.0, apply a patch to fix this issue. As a temporary workaround, consider restricting access to the
sessionReadRecord function until a patch is available.Exploit
Fix
Heap Based Buffer Overflow
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Ibm Aix
Linuxmint
Red Hat
Red Os
Rocky Linux
Sqlite
Ubuntu