CVE-2021-36690

CVE-2021-36690

High · published August 24, 2021

CVSS v3.1
7.5
EPSS
4%
Percentile
90.2
In the wild
Unconfirmed
What it is

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.03898 · 90.2th percentile
Published
2021-08-24T18:15Z
Affected products (6)
ProductVersionsFixed in
sqlite/sqliteall versions—
oracle/zfs_storage_appliance_kitall versions—
apple/iphone_os< 16.016.0
apple/macos< 13.013.0
apple/tvos< 16.016.0
apple/watchos< 9.09.0
References (22)
http://seclists.org/fulldisclosure/2022/Oct/28 · [email protected]http://seclists.org/fulldisclosure/2022/Oct/39 · [email protected]http://seclists.org/fulldisclosure/2022/Oct/41 · [email protected]http://seclists.org/fulldisclosure/2022/Oct/47 · [email protected]http://seclists.org/fulldisclosure/2022/Oct/49 · [email protected]https://support.apple.com/kb/HT213446 · [email protected]https://support.apple.com/kb/HT213486 · [email protected]https://support.apple.com/kb/HT213487 · [email protected]https://support.apple.com/kb/HT213488 · [email protected]https://www.sqlite.org/forum/forumpost/718c0a8d17 · [email protected]http://seclists.org/fulldisclosure/2022/Oct/28 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/Oct/39 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/Oct/41 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/Oct/47 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/Oct/49 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2024/09/msg00050.html · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT213446 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT213486 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT213487 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT213488 · af854a3a-2127-422b-91ae-364da2661108https://www.sqlite.org/forum/forumpost/718c0a8d17 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 24 AUG 00:00Z
    A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query
    cvelistv5