Use-after-free in SQLite - CVE-2024-0232

Vulnerability identifier: #VU87160

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-0232

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the jsonParseAddNodeArray() function in sqlite3.c. A remote attacker can pass specially crafted json data to the application and perform a denial of service (DoS) attack.

SQLite
Netezza Appliance
Oracle Communications Network Charging and Control
webMethods Managed File Transfer
Cloud Pak for Data System - Cyclops
Voice Gateway
Oracle Communications Instant Messaging Server
Nessus Network Monitor
Oracle Communications Convergent Charging Controller
Oracle Financial Services Compliance Studio
PeopleSoft Enterprise PeopleTools
Fedora
Tivoli Composite Application Manager for Transactions
chromium

Install updates from vendor's website.

SQLite - update to 3.43.2
Netezza Appliance - update to 1.0.0.1
Voice Gateway - update to 1.0.8.12
Nessus Network Monitor - update to 6.5.3
Tivoli Composite Application Manager for Transactions - update to 7.4.0.2.24
Cloud Pak for Data System - Cyclops - update to 11.3.1.1
chromium - update to 122.0.6261.57-1.fc39

• https://access.redhat.com/security/cve/CVE-2024-0232
• https://bugzilla.redhat.com/show_bug.cgi?id=2243754
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/

• Denial of service in SQLite
• Fedora 39 update for chromium
• Use-after-free in Oracle Communications Network Charging and Control
• Use-after-free in Oracle Communications Convergent Charging Controller
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• IBM Tivoli Composite Application Manager for Transactions (Response Time) update for SQLite
• Multiple vulnerabilities in Oracle Financial Services Compliance Studio
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Netezza Appliance
• Tenable Network Monitor update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for Data System - Cyclops