Segmentation Fault in SQLite Command-Line Tool Affects Multiple Platforms
CVE-2021-36690

7.5HIGH

Key Information:

Vendor

Sqlite

Status
Sqlite
Vendor
CVE Published:
24 August 2021

What is CVE-2021-36690?

A segmentation fault can be triggered in the sqlite3.exe command-line tool of SQLite version 3.36.0 when a specially crafted SQL query is executed through the idxGetTableInfo function. While the vendor suggests that users of sqlite3.exe inherently have full privileges to execute potentially harmful commands, this issue still highlights a necessary awareness for developers and administrators in understanding how specific SQL queries may impact system integrity. It is essential to evaluate the use cases and configurations of SQLite in any application environment.

References

https://www.sqlite.org/forum/forumpost/718c0a8d17
https://support.apple.com/kb/HT213446
https://support.apple.com/kb/HT213488

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-36690 : Segmentation Fault in SQLite Command-Line Tool Affects Multiple Platforms