The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade sqlite | Oct 5, 2017 | Jul 7, 2017 |
| Apple Osx Sqlite | — | Upgrade macOS to the latest version | Sep 26, 2017 | Jul 7, 2017 |
| Debian | — | Upgrade sqlite3 | Feb 20, 2019 | Jul 7, 2017 |
| Freebsd | — | Upgrade sqlite3 | Aug 8, 2017 | Aug 8, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade sqlite-develUpgrade sqlite | Jul 23, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade sqliteUpgrade sqlite-devel | Sep 25, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade sqlite-develUpgrade sqlite | Jun 27, 2019 | Jul 7, 2017 |
| Oracle Solaris | — | Upgrade database/sqlite-3 to version 3.17.0-0.175.3.27.0.3.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.17.0-0.175.3.27.0.3.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.17.0-0.175.3.27.0.3.0 on Solaris 11.3 | Dec 19, 2017 | Jul 7, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 6, 2017 |
| Suse | — | Upgrade sqlite3Upgrade libsqlite3-0Upgrade sqlite3-develUpgrade libsqlite3-0-32bit | May 11, 2019 | Jul 7, 2017 |
| Ubuntu | — | Upgrade libsqlite3-0Upgrade sqlite3 (Ubuntu Pro)Upgrade libsqlite3-0 (Ubuntu Pro)Upgrade sqlite3 | Jun 20, 2019 | Jul 7, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 7, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub