Denial Of Service (DoS)

sqlite3 is vulnerable to denial of service. The vulnerability exists because the library does not properly verify the ToString function's return values in statement.cc before casting to the utf-8 encoding, allowing an attacker to crash the application by providing invalid parameters...

7ghost (>=4.11.0, <=4.11.46), 90crew-sqlite-async (0.0.4) +196 more potentially affected by CVE-2022-21227 via sqlite3 (>=5.0.0, <=5.0.2)

sqlite3 NPM version =5.0.0, =4.11.0, =0.1.0, =1.1.0, =12.1.0-alpha.6, =2.0.11, =0.2.5, =0.1.3-alpha.0, =0.1.19-alpha.0, =0.1.11-alpha.0, =0.1.3-alpha.0, =7.0.0-alpha.18, =7.3.8 and more Source cves: CVE-2022-21227 Source advisory: OSV:GHSA-9QRH-QJMC-5W2P...

7ghost (>=4.11.0, <=4.11.46), 90crew-sqlite-async (0.0.4) +196 more potentially affected by CVE-2022-21227 via sqlite3 (>=5.0.0, <=5.0.2)

sqlite3 NPM version =5.0.0, =4.11.0, =0.1.0, =1.1.0, =12.1.0-alpha.6, =2.0.11, =0.2.5, =0.1.3-alpha.0, =0.1.19-alpha.0, =0.1.11-alpha.0, =0.1.3-alpha.0, =7.0.0-alpha.18, =7.3.8 and more Source cves: CVE-2022-21227 Source advisory: GHSA-9QRH-QJMC-5W2P...

Denial-of-Service when binding invalid parameters in sqlite3

Affected versions of sqlite3 will experience a fatal error when supplying a specific object in the parameter array. This error causes the application to crash and could not be caught. Users of sqlite3 v5.0.0, v5.0.1 and v5.0.2 are affected by this. This issue is fixed in v5.0.3. All users are...

GHSA-9QRH-QJMC-5W2P Denial-of-Service when binding invalid parameters in sqlite3

Affected versions of sqlite3 will experience a fatal error when supplying a specific object in the parameter array. This error causes the application to crash and could not be caught. Users of sqlite3 v5.0.0, v5.0.1 and v5.0.2 are affected by this. This issue is fixed in v5.0.3. All users are...

PT-2022-6940

Name of the Vulnerable Software and Affected Versions sqlite3 versions 5.0.0 through 5.0.2 Description The issue is related to an uncontrolled resource consumption in the V8 component of the SQLite database management system, which can lead to a Denial of Service DoS. Exploitation of this issue c...

sqlite3:ossfuzz: Use-of-uninitialized-value in sqlite3VdbeChangeEncoding

Detailed Report: https://oss-fuzz.com/testcase?key=5747350217293824 Project: sqlite3 Fuzzing Engine: libFuzzer Fuzz Target: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sqlite3VdbeChangeEncoding sqlite3VdbeExec...

sqlite3:ossfuzz: Use-of-uninitialized-value in setResultStrOrError

Detailed Report: https://oss-fuzz.com/testcase?key=5313340013936640 Project: sqlite3 Fuzzing Engine: libFuzzer Fuzz Target: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: setResultStrOrError printfFunc sqlite3VdbeExec...

sqlite3:ossfuzz: Use-of-uninitialized-value in sqlite3VdbeChangeEncoding

Detailed Report: https://oss-fuzz.com/testcase?key=4546929305976832 Project: sqlite3 Fuzzing Engine: libFuzzer Fuzz Target: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sqlite3VdbeChangeEncoding sqlite3resultvalue...

OPENSUSE-SU-2022:0953-1 Security update for perl-DBD-SQLite

This update for perl-DBD-SQLite fixes the following issues: - updated to 1.66 - Use external sqlite3 library rather than internal code. bsc1195771...

SUSE-SU-2022:0953-1 Security update for perl-DBD-SQLite

This update for perl-DBD-SQLite fixes the following issues: - updated to 1.66 - Use external sqlite3 library rather than internal code. bsc1195771...

PT-2022-37440

Name of the Vulnerable Software and Affected Versions perl-DBD-SQLite versions prior to 1.66 Description The issue is related to the use of an internal sqlite3 library rather than an external one. This has been fixed by updating to version 1.66 and using the external sqlite3 library...

Security update for perl-DBD-SQLite (moderate)

openSUSE Security Update: Security update for perl-DBD-SQLite Announcement ID: openSUSE-SU-2022:0953-1 Rating: moderate References: 1195771 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 An update that contains security fixes can now be installed. Description: This update for...

PT-2022-36628

Name of the Vulnerable Software and Affected Versions perl-DBD-SQLite versions prior to 1.66 Description The issue is related to an update in perl-DBD-SQLite, where the version has been updated to 1.66 and now uses an external sqlite3 library instead of internal code. Recommendations For versions...

FreeTAKServer-UI SQL Injection Vulnerability

FreeTAKServer-UI is an open source FTS web interface from the FreeTAKTeam team.FreeTAKServer-UI is vulnerable to SQL injection, which stems from the API endpoint/AuthenticateUser containing SQL injection into the SQLite3 database, which can be exploited by an attacker to obtain the database All...

PT-2022-6931

Name of the Vulnerable Software and Affected Versions colord affected versions not specified Description The issue is related to two Information Disclosure vulnerabilities in colord. These vulnerabilities are located in colord/src/cd-device-db.c and colord/src/cd-profile-db.c. The problem arises...

Memory corruption

DISPUTED A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries made via editing the Database File, it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user...

CVE-2021-45346

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries made via editing the Database File, it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain...

CVE-2021-45346: Missing Release of Memory after Effective Lifetime

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries made via editing the Database File, it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine. PoC js let sqlite3 = require'sqlite3'.verbose; let db = new...