The vulnerability of the OLE DB driver for SQL Server, related to the use of memory after it is freed, allows a hacker to execute arbitrary code.

🗓️ 08 Aug 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

The OLE DB driver for SQL Server has a memory after free vulnerability enabling remote code execution.

Reporter	Title	Published	Views	Family All 22
CNNVD	Microsoft SQL Server Security Vulnerability	9 Jul 202400:00	–	cnnvd
CVE	CVE-2024-21303	9 Jul 202417:02	–	cve
Cvelist	CVE-2024-21303 SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability	9 Jul 202417:02	–	cvelist
EUVD	EUVD-2024-19016	3 Oct 202520:07	–	euvd
Microsoft KB	KB5040936 - Description of the security update for SQL Server 2022 GDR: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040939 - Description of the security update for SQL Server 2022 CU13: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040940 - Description of the security update for SQL Server 2017 CU31: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040942 - Description of the security update for SQL Server 2017 GDR: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040944 - Description of the security update for SQL Server 2016 SP3 Azure Connect Feature Pack: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040946 - Description of the security update for SQL Server 2016 SP3 GDR: July 9, 2024	9 Jul 202407:00	–	mskb

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21303
vulners	www.vulners.com/cve/CVE-2024-21303
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
web	www.web.nvd.nist.gov/view/vuln/detail

08 Aug 2024 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 38.8

CVSS 210

EPSS0.01493

OLE database provider memory after free remote code execution Microsoft SQL Server