CVE-2022-35737CWE-129

CVE-2022-35737

High · published August 3, 2022

CVSS v3.1
7.5
EPSS
24%
Percentile
97.8
In the wild
Unconfirmed
What it is

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.23575 · 97.8th percentile
Weakness
CWE-129 · Improper Validation of Array Index
Published
2022-08-03T10:15Z
Affected products (5)
ProductVersionsFixed in
sqlite/sqlite≥ 1.0.12, < 3.39.23.39.2
netapp/ontap_select_deploy_administration_utilityall versions—
splunk/universal_forwarder≥ 8.2.0, < 8.2.128.2.12
splunk/universal_forwarder≥ 9.0.0, < 9.0.69.0.6
splunk/universal_forwarderall versions—
References (13)
EPSS history
Timeline
  • 03 AUG 00:00Z
    SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API
    cvelistv5