CVE-2024-0232

Name
CVE-2024-0232
Description
A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vdb-entry https://access.redhat.com/security/cve/CVE-2024-0232
issue-tracking https://bugzilla.redhat.com/show_bug.cgi?id=2243754
secalert@redhat.com https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
secalert@redhat.com https://security.netapp.com/advisory/ntap-20240315-0007/

Match rules

CPE URI Source package Min version Max version
shopxo >= 0 < 3.43.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
sqlite 3.18-main 3.41.2-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
sqlite 3.17-main 3.40.1-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
sqlite 3.16-main 3.40.1-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable