CVE-2017-10989 — Out-of-bounds Read in Sqlite
Severity
9.8CRITICALNVD
EPSS
12.5%
top 6.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 7
Latest updateMay 13
Description
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages2 packages
Patches
🔴Vulnerability Details
3📋Vendor Advisories
9💬Community
6Bugzilla▶
CVE-2017-10989 mingw-sqlite: sqlite: Heap-buffer overflow in the getNodeSize function [epel-7]↗2017-07-11
Bugzilla
▶
Bugzilla▶
CVE-2017-10989 mingw-sqlite: sqlite: Heap-buffer overflow in the getNodeSize function [fedora-all]↗2017-07-11
Bugzilla▶
CVE-2017-10989 sqlite2: sqlite: Heap-buffer overflow in the getNodeSize function [epel-all]↗2017-07-11