CVE-2023-7104

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
ADJACENT_NETWORK
LOW
LOW
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
Affected Products (NVD)
VendorProductVersion
sqlitesqlite
𝑥
≤ 3.43.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
sqlite3
bookworm
3.40.1-2+deb12u1
fixed
bullseye
vulnerable
bullseye (security)
3.34.1-3+deb11u1
fixed
buster
no-dsa
sid
3.46.1-1
fixed
trixie
3.46.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sqlite
bionic
not-affected
focal
not-affected
jammy
not-affected
lunar
dne
mantic
dne
noble
dne
oracular
dne
trusty
not-affected
xenial
not-affected
sqlite3
bionic
Fixed 3.22.0-1ubuntu0.7+esm1
released
focal
Fixed 3.31.1-4ubuntu0.6
released
jammy
Fixed 3.37.2-2ubuntu0.3
released
lunar
Fixed 3.40.1-1ubuntu0.1
released
mantic
Fixed 3.42.0-1ubuntu0.1
released
noble
not-affected
oracular
not-affected
trusty
not-affected
xenial
not-affected
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
lemon
RHEL 8
0:3.26.0-19.el8_9
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.8 AUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 E4S
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 EUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 TUS
0:3.26.0-18.el8_8.1
fixed
sqlite
RHEL 8
0:3.26.0-19.el8_9
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.8 AUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 E4S
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 EUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 TUS
0:3.26.0-18.el8_8.1
fixed
RHEL 9
0:3.34.1-7.el9_3
fixed
sqlite-devel
RHEL 8
0:3.26.0-19.el8_9
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.8 AUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 E4S
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 EUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 TUS
0:3.26.0-18.el8_8.1
fixed
RHEL 9
0:3.34.1-7.el9_3
fixed
sqlite-doc
RHEL 8
0:3.26.0-19.el8_9
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.8 AUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 E4S
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 EUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 TUS
0:3.26.0-18.el8_8.1
fixed
sqlite-libs
RHEL 8
0:3.26.0-19.el8_9
fixed
RHEL 8.6 AUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 E4S
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 EUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.6 TUS
0:3.26.0-16.el8_6.2
fixed
RHEL 8.8 AUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 E4S
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 EUS
0:3.26.0-18.el8_8.1
fixed
RHEL 8.8 TUS
0:3.26.0-18.el8_8.1
fixed
RHEL 9
0:3.34.1-7.el9_3
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
lemon
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
lemon-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
nspr
Amazon Linux 2023
0:4.35.0-5.amzn2023.0.5
fixed
nspr-debuginfo
Amazon Linux 2023
0:4.35.0-5.amzn2023.0.5
fixed
nspr-devel
Amazon Linux 2023
0:4.35.0-5.amzn2023.0.5
fixed
nss
Amazon Linux 2
0:3.90.0-2.amzn2.0.2
fixed
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-debuginfo
Amazon Linux 2
0:3.90.0-2.amzn2.0.2
fixed
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-debugsource
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-devel
Amazon Linux 2
0:3.90.0-2.amzn2.0.2
fixed
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-pkcs11-devel
Amazon Linux 2
0:3.90.0-2.amzn2.0.2
fixed
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-softokn
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-softokn-debuginfo
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-softokn-devel
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-softokn-freebl
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-softokn-freebl-debuginfo
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-softokn-freebl-devel
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-sysinit
Amazon Linux 2
0:3.90.0-2.amzn2.0.2
fixed
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-sysinit-debuginfo
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-tools
Amazon Linux 2
0:3.90.0-2.amzn2.0.2
fixed
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-tools-debuginfo
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-util
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-util-debuginfo
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
nss-util-devel
Amazon Linux 2023
0:3.90.0-3.amzn2023.0.5
fixed
polkit
Amazon Linux 2023
0:0.117-11.amzn2023.0.1
fixed
polkit-debuginfo
Amazon Linux 2023
0:0.117-11.amzn2023.0.1
fixed
polkit-debugsource
Amazon Linux 2023
0:0.117-11.amzn2023.0.1
fixed
polkit-devel
Amazon Linux 2023
0:0.117-11.amzn2023.0.1
fixed
polkit-docs
Amazon Linux 2023
0:0.117-11.amzn2023.0.1
fixed
polkit-libs
Amazon Linux 2023
0:0.117-11.amzn2023.0.1
fixed
polkit-libs-debuginfo
Amazon Linux 2023
0:0.117-11.amzn2023.0.1
fixed
sqlite
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-analyzer
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-analyzer-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-debugsource
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-devel
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-doc
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-libs
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-libs-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-tcl
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-tcl-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-tools
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
sqlite-tools-debuginfo
Amazon Linux 2023
0:3.40.0-1.amzn2023.0.4
fixed
thunderbird
Amazon Linux 2
0:115.6.0-1.amzn2.0.2
fixed
thunderbird-debuginfo
Amazon Linux 2
0:115.6.0-1.amzn2.0.2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
sqlite
CBL-Mariner 2.0
0:3.39.2-3.cm2
fixed
Common Weakness Enumeration
References
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/
https://security.netapp.com/advisory/ntap-20240112-0008/
https://sqlite.org/forum/forumpost/5bcbf4571c
https://sqlite.org/src/info/0e4e7a05c4204b47
https://vuldb.com/?ctiid.248999
https://vuldb.com/?id.248999
https://lists.debian.org/debian-lts-announce/2024/09/msg00050.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/
https://security.netapp.com/advisory/ntap-20240112-0008/
https://sqlite.org/forum/forumpost/5bcbf4571c
https://sqlite.org/src/info/0e4e7a05c4204b47
https://vuldb.com/?ctiid.248999
https://vuldb.com/?id.248999