CVE-2024-0232Medium· 4.7▾ SunlitA heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentia…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.
sqlite >= 3.43.0, < 3.43.2enterprise_linux = 8.0enterprise_linux = 9.0extra_packages_for_enterprise_linux = 8.0fedora = 39Upgrade past the affected range:
sqlite 3.43.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-7104Medium· 5.5A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical
CVE-2021-20227Medium· 5.5A flaw was found in SQLite's SELECT query functionality (src/select.c)
CVE-2020-13871High· 7.5SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-11656Critical· 9.8In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CVE-2019-5018High· 8.1An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0
CVE-2020-13630High· 7.0ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.