SQLite up to 3.34.0 SELECT Query src/select.c use after free

Summaryinfo

A vulnerability marked as problematic has been reported in SQLite up to 3.34.0. This impacts an unknown function of the file src/select.c of the component SELECT Query Handler. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2021-20227. The attack must be initiated from a local position. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in SQLite up to 3.34.0. It has been classified as problematic. This affects an unknown code of the file src/select.c of the component SELECT Query Handler. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was shared 03/24/2021. The advisory is shared at bugzilla.redhat.com. This vulnerability is uniquely identified as CVE-2021-20227. Technical details are known, but no exploit is available.

Upgrading to version 3.34.1 eliminates this vulnerability. The upgrade is hosted for download at sqlite.org.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• SQLite

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34.0

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion