Описание
An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.
An integer overflow flaw has been discovered in SQLite. This flaw allows an attacker who has the ability to execute raw SQL statements to induce a denial of service or leak process memory.
Отчет
A MODERATE severity integer overflow flaw was found in SQLite's sqlite3KeyInfoFromExprList function. An attacker who already has the ability to execute arbitrary SQL statements against an application using an affected SQLite version (3.39.2 through 3.41.1) could supply a crafted SELECT statement with a large number of expressions in the ORDER BY clause, causing a denial of service or the disclosure of sensitive information from process memory. Because successful exploitation requires the attacker to already be able to run raw SQL statements, Red Hat Product Security has rated this flaw as MODERATE rather than the CRITICAL severity assigned by NIST, which assumes a remote, unauthenticated attacker with no prior access. The sqlite packages shipped in Red Hat Enterprise Linux are not affected because the vulnerable code is not present in the shipped versions. The same applies to Red Hat Enterprise Linux components that carry their own copy of SQLite, such as Firefox, Thunderbird, Node.js 22, and the Rust toolset, and to the mingw-sqlite packages; a small number of older Red Hat Enterprise Linux update streams were closed as wontfix rather than fixed. Red Hat OpenShift Container Platform images built on RHEL CoreOS 9 are not affected because the vulnerable code is not present, and a fix for the affected RHEL CoreOS 8 based OpenShift Container Platform 4.12 images has been delivered. In Red Hat In-Vehicle OS, the sqlite package and the Firefox, Thunderbird, and Rust components that bundle SQLite are affected, and fixes are being pursued with the delegated product teams. In the community projects, the qt5-qtwebengine and qt6-qtwebengine packages in EPEL are affected, while the affected Fedora packages are either out of support or marked wontfix.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | firefox | Not affected | ||
| Red Hat Enterprise Linux 10 | sqlite | Will not fix | ||
| Red Hat Enterprise Linux 10 | thunderbird | Not affected | ||
| Red Hat Enterprise Linux 6 | sqlite | Not affected | ||
| Red Hat Enterprise Linux 7 | firefox | Not affected | ||
| Red Hat Enterprise Linux 7 | sqlite | Not affected | ||
| Red Hat Enterprise Linux 8 | firefox | Will not fix | ||
| Red Hat Enterprise Linux 8 | mingw-sqlite | Not affected | ||
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | Not affected | ||
| Red Hat Enterprise Linux 8 | rust-toolset:rhel8/rust | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.
An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.
SQLite integer overflow in key info allocation may lead to information disclosure.
An integer overflow in the sqlite3KeyInfoFromExprList function in SQLi ...
An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.
EPSS
6.1 Medium
CVSS3