CVE-2023-7104
Published: December 29, 2023Last modified: November 6, 2024
Description
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.3 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | LOW |
| Integrity impact | LOW |
| Availability impact | LOW |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | sqlite | Fixed (3.40.1-r1) |
| Stream | sqlite | Fixed (3.43.2-r0) | |
| Liberica JDK | 8 | jdk-full | Fixed (8u432+7) |
| jre-full | Fixed (8u432+7) | ||
| 11 | jdk-full | Fixed (11.0.24+9) | |
| jre-full | Fixed (11.0.24+9) | ||
| 17 | jdk-full | Fixed (17.0.13+12) | |
| jre-full | Fixed (17.0.13+12) | ||
| 21 | jdk-full | Fixed (21.0.5+11) | |
| jre-full | Fixed (21.0.5+11) | ||
| Liberica NIK | 23 (JDK 17) | full | Fixed (23.0.6+1) |
| 23 (JDK 21) | full | Fixed (23.1.5+1) |
References
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/
- https://security.netapp.com/advisory/ntap-20240112-0008/
- https://sqlite.org/forum/forumpost/5bcbf4571c
- https://sqlite.org/src/info/0e4e7a05c4204b47
- https://vuldb.com/?ctiid.248999
- https://vuldb.com/?id.248999