Description

An issue was found in fts5UnicodeTokenize() in ext/fts5/fts5_tokenize.c in Sqlite. A unicode61 tokenizer configured to treat unicode "control-characters" (class Cc), was treating embedded nul characters as tokens. The issue was fixed in sqlite-3.34.0 and later.

Remediation

References

CVE-2021-20223

Related Vulnerabilities

WordPress Plugin Store Locator Plus for WordPress Multiple Vulnerabilities (3.0.1)

Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-37251)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-42119)

WordPress Plugin Simple Flash Video Cross-Site Scripting (1.7)

PHP Numeric Errors Vulnerability (CVE-2009-4418)

Severity

Critical

Classification

CVE-2021-20223 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities