Description
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- Apple / iphone_os16.0
- Apple / macOS13.0
- Apple / tvOS16.0
- Apple / watchOS9.0
- oracle / zfs_storage_appliance_kit8.8 – 8.8
- SQLite / SQLite3.36.0 – 3.36.0
References
- MISChttps://www.sqlite.org/forum/forumpost/718c0a8d17
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213446
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213488
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213486
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213487
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Oct/41
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Oct/28
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Oct/39
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Oct/49
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Oct/47
Updated 44m ago · 8 sources