An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade lemonUpgrade sqlite-develUpgrade sqlite-libsUpgrade sqlite-docUpgrade sqlite | May 4, 2022 | May 10, 2019 |
| Alpine Linux | — | Upgrade sqlite | Nov 8, 2019 | May 10, 2019 |
| Centos_linux | — | Upgrade sqlite-analyzer-debuginfoUpgrade sqlite-debugsourceUpgrade sqliteUpgrade sqlite-docUpgrade sqlite-libs-debuginfoUpgrade lemonUpgrade sqlite-libsUpgrade sqlite-tcl-debuginfoUpgrade sqlite-develUpgrade sqlite-debuginfoUpgrade lemon-debuginfo | Nov 5, 2020 | May 10, 2019 |
| Debian | — | Upgrade sqlite3 | Jul 30, 2024 | May 10, 2019 |
| Freebsd | — | Upgrade sqlite3 | May 27, 2019 | May 26, 2019 |
| Gentoo Linux | — | Upgrade dev-db/sqlite. | Aug 16, 2019 | May 10, 2019 |
| Oracle_linux | — | Upgrade sqlite-docUpgrade sqlite-libsUpgrade sqliteUpgrade lemonUpgrade sqlite-devel | Nov 12, 2020 | May 9, 2019 |
| Redhat_linux | — | Upgrade sqlite-debuginfoUpgrade sqliteUpgrade lemon-debuginfoUpgrade sqlite-develUpgrade sqlite-debugsourceUpgrade sqlite-tcl-debuginfoUpgrade sqlite-analyzer-debuginfoUpgrade sqlite-libs-debuginfoUpgrade lemonUpgrade sqlite-docUpgrade sqlite-libs | Nov 5, 2020 | May 10, 2019 |
| Ubuntu | — | Upgrade sqlite3Upgrade libsqlite3-0 | Dec 3, 2019 | May 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub