Buffer overflow in SQLite - CVE-2023-36191

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU77781

Buffer overflow in SQLite - CVE-2023-36191

Published: June 29, 2023 / Updated: March 13, 2024


Vulnerability identifier: #VU77781
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-36191
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within shell.c. A local user can send a specially crafted request to the database to trigger memory corruption and perform a denial of service (DoS) attack.


Affected software

SQLite
Amazon Linux AMI
Fedora
macOS
openEuler
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Transformation Advisor
sqlite
sqlite-devel
sqlite-debuginfo
sqlite-debugsource
sqlite-help
chromium

How to mitigate CVE-2023-36191

Install update from vendor's website.

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.1
macOS - addressed in versions 12.7.1 21G920, 13.6.1 22G313, 14.1 23B74
IBM Cloud Transformation Advisor - update to 3.7.0
sqlite - update to 3.37.2-6
sqlite-devel - update to 3.37.2-6
sqlite-debuginfo - update to 3.37.2-6
sqlite-debugsource - update to 3.37.2-6
sqlite-help - update to 3.37.2-6
sqlite - update to 3.40.0-1
chromium - addressed in versions 114.0.5735.198-1.el7, 114.0.5735.198-1.el8, 114.0.5735.198-1.el9, 114.0.5735.198-1.fc37, 114.0.5735.198-1.fc38

External References

Related Security Bulletins