Description
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High
Affected Packages3 packages
🔴Vulnerability Details
5OSV`libsqlite3-sys` via C SQLite improperly validates array index↗2022-08-04 GHSA`libsqlite3-sys` via C SQLite improperly validates array index↗2022-08-04 OSV`libsqlite3-sys` via C SQLite CVE-2022-35737↗2022-08-03 OSVCVE-2022-35737: SQLite 1↗2022-08-03 CVEListCVE-2022-35737: SQLite 1↗2022-08-03 📋Vendor Advisories
9MicrosoftMITRE: CVE-2022-35737 SQLite allows an array-bounds overflow↗2024-01-09 OracleOracle Oracle Communications Risk Matrix: Policy (SQLite) — CVE-2022-35737↗2023-04-15 OracleOracle Oracle Communications Applications Risk Matrix: IMAP (NSS) — CVE-2022-35737↗2023-01-15 UbuntuSQLite vulnerability↗2022-11-21 UbuntuSQLite vulnerability↗2022-11-07 🕵️Threat Intelligence
2TrailofbitsStranger Strings: An exploitable flaw in SQLite↗2022-10-25 TrailofbitsStranger Strings: An exploitable flaw in SQLite↗2022-10-25