IM
IronMonkey Threat Research

CVE-2023-7104 HIGH

Published: 2023-12-29 | Last Modified: 2025-11-03 | Status: Modified

Description

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

Additional Descriptions (1)

Una vulnerabilidad fue encontrada en SQLite SQLite3 hasta 3.43.0 y clasificada como crítica. Este problema afecta la función sessionReadRecord del archivo ext/session/sqlite3session.c del componente make alltest Handler. La manipulación conduce a un desbordamiento de búfer de almacenamiento dinámico. Se recomienda aplicar un parche para solucionar este problema. El identificador asociado de esta vulnerabilidad es VDB-248999.

CVSS Metrics

Base Score: 7.3 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactLOW
Integrity ImpactLOW
Availability ImpactLOW

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.4

Base Score: 5.2 (MEDIUM)

AV:A/AC:L/Au:S/C:P/I:P/A:P

Access VectorADJACENT_NETWORK
Access ComplexityLOW
AuthenticationSINGLE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Secondary

Exploitability Score: 5.1

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-122
[email protected] Primary
en CWE-119

Affected Products

Vendor Product Version Update Type
sqlite sqlite * <built-in method update of dict object at 0x7fd2dbff7580> Application
fedoraproject fedora 38 <built-in method update of dict object at 0x7fd2dbff64c0> Operating System
fedoraproject fedora 39 <built-in method update of dict object at 0x7fd3855dd100> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

References