CVE-2022-35737 : SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds over

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Published 2022-08-03 06:15:08

Updated 2024-03-27 16:05:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-35737

Netapp » Ontap Select Deploy Administration Utility » Version: N/A
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Matching versions
Sqlite » Sqlite
Versions from including (>=) 1.0.12 and before (<) 3.39.2
cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*
Matching versions
Splunk » Universal Forwarder
Versions from including (>=) 8.2.0 and before (<) 8.2.12
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Matching versions
Splunk » Universal Forwarder
Versions from including (>=) 9.0.0 and before (<) 9.0.6
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Matching versions
Splunk » Universal Forwarder » Version: 9.1.0
cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.33%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 71 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-129 Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Assigned by: nvd@nist.gov (Primary)

https://sqlite.org/releaselog/3_39_2.html

SQLite Release 3.39.2 On 2022-07-21
Release Notes;Vendor Advisory
https://security.gentoo.org/glsa/202210-40

SQLite: Multiple Vulnerabilities (GLSA 202210-40) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20220915-0009/

CVE-2022-35737 SQLite Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://www.sqlite.org/cves.html

Vulnerabilities
Vendor Advisory

CVEs referencing this url
https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/

Stranger Strings: An exploitable flaw in SQLite | Trail of Bits Blog
Exploit;Third Party Advisory
https://kb.cert.org/vuls/id/720344

Broken Link;Third Party Advisory;US Government Resource

Jump to