SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.
SQLite antes de 3.53.2 contiene una vulnerabilidad de desbordamiento de búfer basado en montículo en la extensión de búsqueda de texto completo FTS5 que permite a los atacantes causar un fallo o ejecutar código arbitrario al proporcionar una base de datos manipulada con metadatos de página de continuación maliciosos especificando un valor szLeaf menor que 4. Los atacantes pueden desencadenar un desbordamiento negativo de enteros en fts5ChunkIterate() causando un recuento inflado de bytes restantes durante el procesamiento de consultas FTS5 MATCH, lo que lleva a un desbordamiento de búfer de montículo de datos controlados por el atacante en aplicaciones compiladas con SQLITE_ENABLE_FTS5.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Attack Requirements | NONE |
| Privileges Required | NONE |
| User Interaction | PASSIVE |
| Vulnerability Confidentiality | HIGH |
| Vulnerability Integrity | HIGH |
| Vulnerability Availability | HIGH |
| Subsequent Confidentiality | NONE |
| Subsequent Integrity | NONE |
| Subsequent Availability | NONE |
Source: [email protected]
Type: Secondary
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-122
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| sqlite | sqlite | * | <built-in method update of dict object at 0x7fd39c4b5a00> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* |