An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade sqlite-libsUpgrade sqlite-develUpgrade lemonUpgrade sqliteUpgrade sqlite-doc | May 4, 2022 | May 10, 2019 |
| Alpine Linux | — | Upgrade sqlite | Nov 8, 2019 | May 10, 2019 |
| Centos_linux | — | Upgrade lemon-debuginfoUpgrade sqlite-develUpgrade sqlite-debuginfoUpgrade sqlite-tcl-debuginfoUpgrade sqlite-analyzer-debuginfoUpgrade sqlite-libsUpgrade sqlite-debugsourceUpgrade lemonUpgrade sqlite-libs-debuginfoUpgrade sqlite-docUpgrade sqlite | Nov 5, 2020 | May 10, 2019 |
| Debian | — | Upgrade sqlite3 | Jul 30, 2024 | May 10, 2019 |
| Freebsd | — | Upgrade sqlite3 | May 27, 2019 | May 26, 2019 |
| Gentoo Linux | — | Upgrade dev-db/sqlite. | Aug 16, 2019 | May 10, 2019 |
| Oracle_linux | — | Upgrade lemonUpgrade sqliteUpgrade sqlite-develUpgrade sqlite-libsUpgrade sqlite-doc | Nov 12, 2020 | May 9, 2019 |
| Redhat_linux | — | Upgrade sqlite-debugsourceUpgrade lemon-debuginfoUpgrade sqliteUpgrade sqlite-analyzer-debuginfoUpgrade sqlite-tcl-debuginfoUpgrade sqlite-develUpgrade sqlite-debuginfoUpgrade sqlite-libsUpgrade sqlite-libs-debuginfoUpgrade lemonUpgrade sqlite-doc | Nov 5, 2020 | May 10, 2019 |
| Ubuntu | — | Upgrade sqlite3Upgrade libsqlite3-0 | Dec 3, 2019 | May 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub