CVE-2024-0232

2024-01-1614:15:48

Alpine Linux Development Team

security.alpinelinux.org

sqlite

heap use-after-free

jsonparseaddnodearray

denial of service

unix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.8%

JSON

A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.

OSVersionArchitecturePackageVersionFilename
Alpine3.18-mainnoarchsqlite= 3.41.2-r3UNKNOWN
Alpine3.17-mainnoarchsqlite= 3.40.1-r1UNKNOWN
Alpine3.16-mainnoarchsqlite= 3.40.1-r1UNKNOWN