Use-after-free in SQLite - CVE-2024-0232

Vulnerability identifier: #VU87160

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-0232

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
SQLite
Netezza Appliance
Oracle Communications Network Charging and Control
webMethods Managed File Transfer
Cloud Pak for Data System - Cyclops
Voice Gateway
Oracle Communications Instant Messaging Server
Nessus Network Monitor
Oracle Communications Convergent Charging Controller
Oracle Financial Services Compliance Studio
PeopleSoft Enterprise PeopleTools
Fedora
Tivoli Composite Application Manager for Transactions
chromium

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the jsonParseAddNodeArray() function in sqlite3.c. A remote attacker can pass specially crafted json data to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://access.redhat.com/security/cve/CVE-2024-0232
• https://bugzilla.redhat.com/show_bug.cgi?id=2243754
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/