248 matches found
PYSEC-2024-25
DuckDB =0.9.2 and DuckDB extension-template =0.9.2 are vulnerable to malicious extension injection via the custom extension feature...
Code injection
DuckDB =0.9.2 and DuckDB extension-template =0.9.2 are vulnerable to malicious extension injection via the custom extension feature...
CVE-2024-22682
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2024-22682
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PYSEC-2024-25
DuckDB =0.9.2 and DuckDB extension-template =0.9.2 are vulnerable to malicious extension injection via the custom extension feature...
Number withdrawn
DuckDB is an in-process SQL OLAP database management system from DuckDB Open Source. This CVE number has been withdrawn...
CVE-2024-22682
CVE-2024-22682 concerns DuckDB and its extension-template. Affected: DuckDB versions prior to 0.9.3 and DuckDB extension-template prior to 0.9.3. Issue: malicious extension injection via the custom extension feature. Impact: allows injection through the extension mechanism as described by multipl...
PT-2024-19529 · Duckdb +1 · Duckdb +1
Name of the Vulnerable Software and Affected Versions: DuckDB versions prior to 0.9.3 DuckDB extension-template versions prior to 0.9.3 Description: The issue allows for malicious extension injection through the custom extension feature. Recommendations: For DuckDB versions prior to 0.9.3, update...
duckdb:parse_fuzz_test: Heap-buffer-overflow in void duckdb::BinaryExecutor::ExecuteConstant<long, long, long, duckdb::BinarySta
Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=5223464846622720 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerasanduckdb Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...
duckdb:parse_fuzz_test: Container-overflow in duckdb_tdigest::TDigest::process
Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=5869382900514816 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerasanduckdb Platform Id: linux Crash Type: Container-overflow READ 16 Crash Address:...
duckdb:parse_fuzz_test: Bad-cast to duckdb::ResetVariableStatement from duckdb::SetStatement in duckdb::Binder::Bind
Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=6048141818593280 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerubsanduckdb Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000050794b0 Crash State:...
duckdb:parse_fuzz_test: Heap-use-after-free in duckdb::HashJoinFinalizeEvent::FinishEvent
Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=5144866891366400 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerasanduckdb Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...
duckdb:parse_fuzz_test: Crash in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch
Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=4690585050546176 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerubsanduckdb Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffffffffffffff Crash...
duckdb:parse_fuzz_test: Segv on unknown address in duckdb::StringUtil::Split
Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=5685636882890752 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerasanduckdb Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...
duckdb:parse_fuzz_test: Bad-cast to duckdb::BoundParameterExpression from duckdb::BoundCastExpression in duckdb::Planner::CreatePlan
Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=4800152795217920 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerubsanduckdb Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000004d6bfa0 Crash State:...
duckdb:parse_fuzz_test: Stack-buffer-overflow in duckdb::utf8proc_next_grapheme
Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=5082369452802048 Project: duckdb Fuzzing Engine: honggfuzz Fuzz Target: parsefuzztest Job Type: honggfuzzasanduckdb Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address:...
OSV-2022-487 Heap-use-after-free in duckdb::Planner::CreatePlan
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48062 Crash type: Heap-use-after-free READ 1 Crash state: duckdb::Planner::CreatePlan duckdb::Planner::CreatePlan duckdb::ClientContext::CreatePreparedStatement...
PT-2022-37042
Name of the Vulnerable Software and Affected Versions DuckDB affected versions not specified Description The issue is related to a heap-use-after-free error. Technical details about the error include the CreatePlan function in the duckdb::Planner class and the CreatePreparedStatement function in...
duckdb:parse_fuzz_test: Heap-use-after-free in duckdb::Planner::CreatePlan
Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=4777940912570368 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerasanduckdb Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address:...