Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2022-35737] Stranger Strings: An exploitable flaw in SQLite

blog.trailofbits.com | vulnerability | CVE-2022-35737 | #memory-safety | #cve | #vulnerability-disclosure | #sqlite

Summary

Trail of Bits discloses CVE-2022-35737 in SQLite's printf implementation: present since 2000, fixed in 3.39.2. Large strings with %Q/%q/%w format types cause crashes on 64-bit systems, and the ! unicode flag enables worst-case arbitrary code execution.
Published
Collected

original ↗

Related coverage

  1. Increasing transparency in cloud security: Wiz is now a CVE Numbering Authority (CNA) (wiz.io)
  2. Look out! Divergent representations are everywhere! (blog.trailofbits.com)
  3. A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console (bishopfox.com)
  4. CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gap (yeswehack.com)
  5. A framework for successful vulnerability disclosure policy (yeswehack.com)
  6. Mobilising collective intelligence for better security (yeswehack.com)

back