n/a vulnerability

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Published 3 Aug 2022Updated 14 Oct 202631 sources
CVSS 7.5 ✓ VERIFIED REFERENCE

What happened

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Affected versions

n/a: n/a; V3.1.0 through before V3.1.5 (custom) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

  • Apply vendor-provided updates or mitigations.
  • Review affected product exposure and access logs.

Public PoC references

RepositoryAuthorFirst seenReference
blog.trailofbits.comNVD reference2022-08-03Verified