Description

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.

Remediation

References

CVE-2017-10989

Related Vulnerabilities

Atlassian Jira Missing Authorization Vulnerability (CVE-2019-8445)

WebLogic Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') Vulnerability (CVE-2018-1000613)

WordPress Plugin Duplicate Page SQL Injection (3.3)

Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-39324)

MediaWiki Insertion of Sensitive Information into Log File Vulnerability (CVE-2024-40596)

Severity

Critical

Classification

CVE-2017-10989 CWE-125 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities