CVE-2024-0232

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0232
A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2024-0232 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2243754 Exploit Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
https://security.netapp.com/advisory/ntap-20240315-0007/
Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
History

15 Mar 2024, 11:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240315-0007/ -

23 Feb 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/ -

24 Jan 2024, 14:14

Type Values Removed Values Added
First Time Redhat enterprise Linux
Fedoraproject extra Packages For Enterprise Linux
Sqlite
Fedoraproject
Redhat
Sqlite sqlite
Fedoraproject fedora
References () https://access.redhat.com/security/cve/CVE-2024-0232 - () https://access.redhat.com/security/cve/CVE-2024-0232 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2243754 - () https://bugzilla.redhat.com/show_bug.cgi?id=2243754 - Exploit, Issue Tracking, Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 4.7 		v2 : unknown
v3 : 5.5

16 Jan 2024, 23:12

Type Values Removed Values Added
Summary
  • (es) Se identificó un problema de uso después de la liberación del montón en SQLite en la función jsonParseAddNodeArray() en sqlite3.c. Este fallo permite que un atacante local aproveche a una víctima para que pase entradas maliciosas especialmente manipuladas a la aplicación, lo que podría provocar un fallo y provocar una denegación de servicio.

16 Jan 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-16 14:15

Updated : 2024-03-15 11:15

NVD link : CVE-2024-0232

Mitre link : CVE-2024-0232

CVE.ORG link : CVE-2024-0232

JSON object : View

Products Affected

fedoraproject

  • extra_packages_for_enterprise_linux
  • fedora

redhat

  • enterprise_linux

sqlite

  • sqlite
CWE
CWE-416

Use After Free