CVE-2023-7104: SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
Other sources
SQLite SQLite3 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the sessionReadRecord function in ext/session/sqlite3session.c. By sending a specially crafted request, a remote authenticated attacker could overflow a buffer and execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-7104?
CVE-2023-7104 is classified as a critical vulnerability.
How do I fix CVE-2023-7104?
To mitigate CVE-2023-7104, upgrade SQLite to version 3.43.0 or later.
What component is affected by CVE-2023-7104?
CVE-2023-7104 affects the SQLite3 function sessionReadRecord in the file ext/session/sqlite3session.c.
What type of vulnerability is CVE-2023-7104?
CVE-2023-7104 is a heap-based buffer overflow vulnerability.
Which software versions are vulnerable to CVE-2023-7104?
SQLite versions up to 3.43.0 are vulnerable to CVE-2023-7104.