Log in Start free

Vulnerability · Published Dec 25, 2023 · Assigned by VulDB

CVE-2023-7104SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow

Medium 5.5

In plain English

A medium-severity heap buffer overflow in SQLite3 from SQLite. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.5%top 26.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8lemon3.26.0-19.el8_9ALSA-2024:0253
AlmaLinux:8sqlite3.26.0-19.el8_9ALSA-2024:0253
AlmaLinux:9sqlite3.34.1-7.el9_3ALSA-2024:0465
AlmaLinux:8sqlite-devel3.26.0-19.el8_9ALSA-2024:0253
AlmaLinux:9sqlite-devel3.34.1-7.el9_3ALSA-2024:0465
AlmaLinux:8sqlite-doc3.26.0-19.el8_9ALSA-2024:0253
AlmaLinux:8sqlite-libs3.26.0-19.el8_9ALSA-2024:0253
AlmaLinux:9sqlite-libs3.34.1-7.el9_3ALSA-2024:0465
Alpine:v3.20qt5-qtwebengine5.15.16-r7ALPINE-CVE-2023-7104
Alpine:v3.21qt5-qtwebengine5.15.16-r7ALPINE-CVE-2023-7104
Alpine:v3.22qt5-qtwebengine5.15.16-r7ALPINE-CVE-2023-7104
Alpine:v3.23qt5-qtwebengine5.15.16-r7ALPINE-CVE-2023-7104
Alpine:v3.20qt6-qtwebengine6.6.3-r1ALPINE-CVE-2023-7104
Alpine:v3.21qt6-qtwebengine6.6.3-r1ALPINE-CVE-2023-7104
Alpine:v3.22qt6-qtwebengine6.6.3-r1ALPINE-CVE-2023-7104
Alpine:v3.23qt6-qtwebengine6.6.3-r1ALPINE-CVE-2023-7104
Alpine:v3.24qt6-qtwebengine6.6.3-r1ALPINE-CVE-2023-7104
Debian:12sqlite33.40.1-2+deb12u1DEBIAN-CVE-2023-7104
Debian:13sqlite33.43.1-1DEBIAN-CVE-2023-7104
Debian:14sqlite33.43.1-1DEBIAN-CVE-2023-7104
Rocky Linux:8sqlite0:3.26.0-19.el8_9RLSA-2024:0253
Rocky Linux:9sqlite0:3.34.1-7.el9_3RLSA-2024:0465
Ubuntu:22.04:LTSsqlite33.37.2-2ubuntu0.3UBUNTU-CVE-2023-7104
Ubuntu:22.04:LTSsqlite33.37.2-2ubuntu0.3USN-6566-1

Affected products (as reported)

VendorProductVersions
SQLite SQLite3 3.03.13.23.33.43.53.63.7

Weakness: CWE-122 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References