CVE-2022-35737

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 97.75%
Affected Products (NVD)
VendorProductVersion
sqlitesqlite
1.0.12 ≤
𝑥
< 3.39.2
netappontap_select_deploy_administration_utility
-
splunkuniversal_forwarder
8.2.0 ≤
𝑥
< 8.2.12
splunkuniversal_forwarder
9.0.0 ≤
𝑥
< 9.0.6
splunkuniversal_forwarder
9.1.0
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP
V3.1.0 ≤
𝑥
< V3.1.5
ADP
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
V3.1.0 ≤
𝑥
< V3.1.5
ADP
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP
V3.1.0 ≤
𝑥
< V3.1.5
ADP
Windows Releases
Platform
Version
Windows 10
1809 (arm64, x64, x86)
KB5034127
21H2 (arm64, x64, x86)
KB5034122
22H2 (arm64, x64, x86)
KB5034122
Windows Server 2019
Server Core
KB5034127
Standard
KB5034127
Windows Server 2022
Server Core
KB5034129
Standard
KB5034129
Debian logo
Debian Releases
Debian Product
Codename
sqlite3
bookworm
3.40.1-2
fixed
bullseye
unimportant
bullseye (security)
unimportant
sid
3.46.1-1
fixed
trixie
3.46.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sqlite
bionic
not-affected
focal
not-affected
jammy
not-affected
kinetic
not-affected
lunar
dne
mantic
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
resolute
dne
trusty
not-affected
xenial
ignored
sqlite3
bionic
Fixed 3.22.0-1ubuntu0.7
released
focal
Fixed 3.31.1-4ubuntu0.5
released
jammy
Fixed 3.37.2-2ubuntu0.1
released
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
trusty
Fixed 3.8.2-1ubuntu2.2+esm3
released
xenial
Fixed 3.11.0-1ubuntu1.5+esm2
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libsqlite3-0
suse enterprise desktop 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise sap 12 SP4
3.39.3-9.23.1
fixed
suse enterprise sap 15
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise server 12 SP2
3.39.3-9.23.1
fixed
suse enterprise server 12 SP3
3.39.3-9.23.1
fixed
suse enterprise server 12 SP4
3.39.3-9.23.1
fixed
suse enterprise server 12 SP5
3.39.3-9.23.1
fixed
suse enterprise server 15
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP7
3.39.3-150000.3.17.1
fixed
libsqlite3-0-32bit
suse enterprise desktop 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise sap 12 SP4
3.39.3-9.23.1
fixed
suse enterprise sap 15
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise server 12 SP2
3.39.3-9.23.1
fixed
suse enterprise server 12 SP3
3.39.3-9.23.1
fixed
suse enterprise server 12 SP4
3.39.3-9.23.1
fixed
suse enterprise server 12 SP5
3.39.3-9.23.1
fixed
suse enterprise server 15
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP7
3.39.3-150000.3.17.1
fixed
sqlite3
suse enterprise desktop 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise sap 12 SP4
3.39.3-9.23.1
fixed
suse enterprise sap 15
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise server 12 SP2
3.39.3-9.23.1
fixed
suse enterprise server 12 SP3
3.39.3-9.23.1
fixed
suse enterprise server 12 SP4
3.39.3-9.23.1
fixed
suse enterprise server 12 SP5
3.39.3-9.23.1
fixed
suse enterprise server 15
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP7
3.39.3-150000.3.17.1
fixed
sqlite3-devel
suse enterprise desktop 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise sap 12 SP4
3.39.3-9.23.1
fixed
suse enterprise sap 15
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise server 12 SP2
3.39.3-9.23.1
fixed
suse enterprise server 12 SP3
3.39.3-9.23.1
fixed
suse enterprise server 12 SP4
3.39.3-9.23.1
fixed
suse enterprise server 12 SP5
3.39.3-9.23.1
fixed
suse enterprise server 15
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP7
3.39.3-150000.3.17.1
fixed
sqlite3-tcl
suse enterprise desktop 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise desktop 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise sap 12 SP4
3.39.3-9.23.1
fixed
suse enterprise sap 15
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise sap 15 SP7
3.39.3-150000.3.17.1
fixed
suse enterprise server 12 SP2
3.39.3-9.23.1
fixed
suse enterprise server 12 SP3
3.39.3-9.23.1
fixed
suse enterprise server 12 SP4
3.39.3-9.23.1
fixed
suse enterprise server 12 SP5
3.39.3-9.23.1
fixed
suse enterprise server 15
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP1
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP2
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP3
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP4
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP5
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP6
3.39.3-150000.3.17.1
fixed
suse enterprise server 15 SP7
3.39.3-150000.3.17.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
lemon
RHEL 8
0:3.26.0-17.el8_7
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.1
fixed
sqlite
RHEL 8
0:3.26.0-17.el8_7
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.1
fixed
RHEL 9
0:3.34.1-6.el9_1
fixed
sqlite-devel
RHEL 8
0:3.26.0-17.el8_7
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.1
fixed
RHEL 9
0:3.34.1-6.el9_1
fixed
sqlite-doc
RHEL 8
0:3.26.0-17.el8_7
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.1
fixed
sqlite-libs
RHEL 8
0:3.26.0-17.el8_7
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.1
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.1
fixed
RHEL 9
0:3.34.1-6.el9_1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
lemon
Amazon Linux 2
0:3.7.17-8.amzn2.1.2
fixed
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
lemon-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite
Amazon Linux 2
0:3.7.17-8.amzn2.1.2
fixed
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-analyzer
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-analyzer-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-debuginfo
Amazon Linux 2
0:3.7.17-8.amzn2.1.2
fixed
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-debugsource
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-devel
Amazon Linux 2
0:3.7.17-8.amzn2.1.2
fixed
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-doc
Amazon Linux 2
0:3.7.17-8.amzn2.1.2
fixed
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-libs
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-libs-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-tcl
Amazon Linux 2
0:3.7.17-8.amzn2.1.2
fixed
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-tcl-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-tools
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
sqlite-tools-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
sqlite
CBL-Mariner 1.0
0:3.34.1-2.cm1
fixed
CBL-Mariner 2.0
0:3.39.2-1.cm2
fixed
Common Weakness Enumeration
References
https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
https://kb.cert.org/vuls/id/720344
https://security.gentoo.org/glsa/202210-40
https://security.netapp.com/advisory/ntap-20220915-0009/
https://sqlite.org/releaselog/3_39_2.html
https://www.sqlite.org/cves.html
https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
https://kb.cert.org/vuls/id/720344
https://security.gentoo.org/glsa/202210-40
https://security.netapp.com/advisory/ntap-20220915-0009/
https://sqlite.org/releaselog/3_39_2.html
https://www.sqlite.org/cves.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html