CVE-2017-10989critical
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.
References
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00050.html
http://marc.info/?l=sqlite-users&m=149933696214713&w=2
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.securityfocus.com/bid/99502
http://www.securitytracker.com/id/1039427
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2405
https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937
https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html
https://sqlite.org/src/info/66de6f4a
https://sqlite.org/src/vpatch?from=0db20efe201736b3&to=66de6f4a9504ec26
https://support.apple.com/HT208112
https://support.apple.com/HT208113
https://support.apple.com/HT208115
https://support.apple.com/HT208144
Details
Source: MITRE
Published: 2017-07-07
Updated: 2019-10-03
Type: CWE-125
Risk Information
CVSS v2
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 10
Severity: HIGH
CVSS v3
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 3.9
Severity: CRITICAL
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* versions up to 3.19.3 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 153643 | SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2021:3215-1) | Nessus | SuSE Local Security Checks | critical |
| 129253 | EulerOS 2.0 SP3 : sqlite (EulerOS-SA-2019-2060) | Nessus | Huawei Local Security Checks | critical |
| 126848 | EulerOS 2.0 SP2 : sqlite (EulerOS-SA-2019-1720) | Nessus | Huawei Local Security Checks | critical |
| 126555 | EulerOS Virtualization for ARM 64 3.0.2.0 : sqlite (EulerOS-SA-2019-1713) | Nessus | Huawei Local Security Checks | critical |
| 126295 | EulerOS 2.0 SP5 : sqlite (EulerOS-SA-2019-1668) | Nessus | Huawei Local Security Checks | critical |
| 126065 | Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : SQLite vulnerabilities (USN-4019-1) | Nessus | Ubuntu Local Security Checks | critical |
| 125986 | SUSE SLES12 Security Update : sqlite3 (SUSE-SU-2019:1522-1) | Nessus | SuSE Local Security Checks | critical |
| 125325 | openSUSE Security Update : sqlite3 (openSUSE-2019-1426) | Nessus | SuSE Local Security Checks | critical |
| 124856 | SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2019:1208-1) | Nessus | SuSE Local Security Checks | critical |
| 700542 | Apple iOS < 11.0.1 Multiple Vulnerabilities | Nessus Network Monitor | Mobile Devices | critical |
| 700511 | macOS < 10.13 Multiple Vulnerabilities | Nessus Network Monitor | Operating System Detection | critical |
| 123743 | EulerOS Virtualization 2.5.3 : sqlite (EulerOS-SA-2019-1275) | Nessus | Huawei Local Security Checks | critical |
| 121717 | Photon OS 1.0: Sqlite PHSA-2017-0025 | Nessus | PhotonOS Local Security Checks | critical |
| 121133 | Debian DLA-1633-1 : sqlite3 security update | Nessus | Debian Local Security Checks | critical |
| 111874 | Photon OS 1.0: Libxslt / Linux / Sqlite PHSA-2017-0025 (deprecated) | Nessus | PhotonOS Local Security Checks | critical |
| 103598 | macOS < 10.13 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
| 103420 | Apple iOS < 11 Multiple Vulnerabilities | Nessus | Mobile Devices | critical |
| 102279 | FreeBSD : sqlite3 -- heap-buffer overflow (9245681c-7c3c-11e7-b5af-a4badb2f4699) | Nessus | FreeBSD Local Security Checks | critical |
| 101868 | Fedora 24 : sqlite (2017-9b752904ed) | Nessus | Fedora Local Security Checks | critical |
| 101776 | Fedora 25 : sqlite (2017-447e926933) | Nessus | Fedora Local Security Checks | critical |
| 101607 | Fedora 26 : spatialite-tools / sqlite (2017-357f9df699) | Nessus | Fedora Local Security Checks | critical |
| 101319 | Debian DLA-1018-1 : sqlite3 security update | Nessus | Debian Local Security Checks | critical |