CVE-2021-36690High· 7.5▾ TwilightA segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe us…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.8 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.9%
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.
sqlite = 3.36.0zfs_storage_appliance_kit = 8.8iphone_os < 16.0macos < 13.0tvos < 16.0watchos < 9.0Upgrade past the affected range:
iphone_os 16.0macos 13.0tvos 16.0watchos 9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2021-31239High· 7.5An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.
CVE-2021-20227Medium· 5.5A flaw was found in SQLite's SELECT query functionality (src/select.c)
CVE-2020-35527Critical· 9.8In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.
CVE-2020-35525High· 7.5In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.
CVE-2020-13871High· 7.5SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-15358Medium· 5.5In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.