486 lines
19 KiB
JSON
486 lines
19 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-7104",
|
|
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "VulDB",
|
|
"dateReserved": "2023-12-25T14:00:48.991Z",
|
|
"datePublished": "2023-12-25T21:00:05.997Z",
|
|
"dateUpdated": "2026-10-14T22:15:28.140Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
|
"shortName": "VulDB",
|
|
"dateUpdated": "2024-01-12T14:06:21.135Z"
|
|
},
|
|
"title": "SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow",
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"type": "CWE",
|
|
"cweId": "CWE-122",
|
|
"lang": "en",
|
|
"description": "CWE-122 Heap-based Buffer Overflow"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"vendor": "SQLite",
|
|
"product": "SQLite3",
|
|
"versions": [
|
|
{
|
|
"version": "3.0",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.1",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.3",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.4",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.5",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.6",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.7",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.8",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.9",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.10",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.11",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.12",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.13",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.14",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.16",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.17",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.18",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.19",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.20",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.21",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.22",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.23",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.24",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.25",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.26",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.27",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.28",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.29",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.30",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.31",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.32",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.33",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.34",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.35",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.36",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.37",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.38",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.39",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.40",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.41",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.42",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "3.43",
|
|
"status": "affected"
|
|
}
|
|
],
|
|
"modules": [
|
|
"make alltest Handler"
|
|
]
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999."
|
|
},
|
|
{
|
|
"lang": "de",
|
|
"value": "Eine kritische Schwachstelle wurde in SQLite SQLite3 bis 3.43.0 gefunden. Hierbei geht es um die Funktion sessionReadRecord der Datei ext/session/sqlite3session.c der Komponente make alltest Handler. Durch die Manipulation mit unbekannten Daten kann eine heap-based buffer overflow-Schwachstelle ausgenutzt werden. Als bestmögliche Massnahme wird Patching empfohlen."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"baseScore": 5.5,
|
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"baseSeverity": "MEDIUM"
|
|
}
|
|
},
|
|
{
|
|
"cvssV3_0": {
|
|
"version": "3.0",
|
|
"baseScore": 5.5,
|
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
|
"baseSeverity": "MEDIUM"
|
|
}
|
|
},
|
|
{
|
|
"cvssV2_0": {
|
|
"version": "2.0",
|
|
"baseScore": 5.2,
|
|
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P"
|
|
}
|
|
}
|
|
],
|
|
"timeline": [
|
|
{
|
|
"time": "2023-12-25T00:00:00.000Z",
|
|
"lang": "en",
|
|
"value": "Advisory disclosed"
|
|
},
|
|
{
|
|
"time": "2023-12-25T01:00:00.000Z",
|
|
"lang": "en",
|
|
"value": "VulDB entry created"
|
|
},
|
|
{
|
|
"time": "2023-12-29T10:49:22.000Z",
|
|
"lang": "en",
|
|
"value": "VulDB entry last update"
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Junwha Hong",
|
|
"type": "finder"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "Wonil Jang",
|
|
"type": "finder"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "qbit (VulDB User)",
|
|
"type": "analyst"
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://vuldb.com/?id.248999",
|
|
"tags": [
|
|
"vdb-entry",
|
|
"technical-description"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://vuldb.com/?ctiid.248999",
|
|
"tags": [
|
|
"signature",
|
|
"permissions-required"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://sqlite.org/forum/forumpost/5bcbf4571c",
|
|
"tags": [
|
|
"related"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://sqlite.org/src/info/0e4e7a05c4204b47",
|
|
"tags": [
|
|
"patch"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/"
|
|
},
|
|
{
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/"
|
|
},
|
|
{
|
|
"url": "https://security.netapp.com/advisory/ntap-20240112-0008/"
|
|
}
|
|
]
|
|
},
|
|
"adp": [
|
|
{
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://vuldb.com/?id.248999",
|
|
"tags": [
|
|
"vdb-entry",
|
|
"technical-description",
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://vuldb.com/?ctiid.248999",
|
|
"tags": [
|
|
"signature",
|
|
"permissions-required",
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://sqlite.org/forum/forumpost/5bcbf4571c",
|
|
"tags": [
|
|
"related",
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://sqlite.org/src/info/0e4e7a05c4204b47",
|
|
"tags": [
|
|
"patch",
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://security.netapp.com/advisory/ntap-20240112-0008/",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00050.html"
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2025-11-03T21:50:49.278Z"
|
|
}
|
|
},
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2025-12-18T15:36:04.361685Z",
|
|
"id": "CVE-2023-7104",
|
|
"options": [
|
|
{
|
|
"Exploitation": "poc"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2025-12-18T15:36:19.304Z"
|
|
}
|
|
},
|
|
{
|
|
"x_adpType": "supplier",
|
|
"providerMetadata": {
|
|
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
|
|
"shortName": "siemens-SADP",
|
|
"dateUpdated": "2026-10-14T22:15:28.140Z"
|
|
},
|
|
"affected": [
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "RUGGEDCOM CROSSBOW Station Access Controller (SAC)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "0",
|
|
"lessThan": "V5.6",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIDIS Prime",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "0",
|
|
"lessThan": "V4.0.700",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "0",
|
|
"lessThan": "V1.1",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html"
|
|
},
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-000297.html"
|
|
},
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
|
|
},
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |