CVE-2023-7104CWE-119CWE-122

CVE-2023-7104

Medium · published December 29, 2023

CVSS v3.1
5.5
EPSS
1%
Percentile
73.4
In the wild
Unconfirmed
What it is

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01464 · 73.4th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-122 · Heap-based Buffer Overflow
Published
2023-12-29T15:15Z
Affected products (3)
ProductVersionsFixed in
sqlite/sqlite≤ 3.43.0—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
References (19)
https://sqlite.org/forum/forumpost/5bcbf4571c · af854a3a-2127-422b-91ae-364da2661108https://sqlite.org/src/info/0e4e7a05c4204b47 · af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.248999 · af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.248999 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-000297.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-277137.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-915275.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://lists.fedoraproject.org/archives/list/[email protected]/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/ · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/ · [email protected]https://security.netapp.com/advisory/ntap-20240112-0008/ · [email protected]https://sqlite.org/forum/forumpost/5bcbf4571c · [email protected]https://sqlite.org/src/info/0e4e7a05c4204b47 · [email protected]https://vuldb.com/?ctiid.248999 · [email protected]https://vuldb.com/?id.248999 · [email protected]https://lists.debian.org/debian-lts-announce/2024/09/msg00050.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240112-0008/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 DEC 21:00Z
    SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow
    cvelistv5