CVE-2020-24736 Memory corruption in n/a
A local attacker can cause a denial of service in SQLite3 via a crafted script due to a buffer overflow vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-24736?
CVE-2020-24736 is a medium-severity memory corruption vulnerability in n/a, published on 11 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script.
Weakness: CWE-120
Which versions are affected by CVE-2020-24736?
It affects 1 product.
Linux distribution packages (23)
lemon AlmaLinux:8 | All versions | 3.26.0-18.el8_8 |
sqlite AlmaLinux:8 | All versions | 3.26.0-18.el8_8 |
sqlite-devel AlmaLinux:8 | All versions | 3.26.0-18.el8_8 |
sqlite-doc AlmaLinux:8 | All versions | 3.26.0-18.el8_8 |
sqlite-libs AlmaLinux:8 | All versions | 3.26.0-18.el8_8 |
lemon Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-18.el8_8 |
lemon-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-18.el8_8 |
sqlite-analyzer-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-18.el8_8 |
sqlite-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-18.el8_8 |
sqlite-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-18.el8_8 |
sqlite-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-18.el8_8 |
sqlite-tcl-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-18.el8_8 |
lemon-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite-analyzer-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite-doc Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite-libs Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite-tcl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-18.el8_8 |
sqlite Rocky Linux:8 | All versions | 0:3.26.0-18.el8_8 |
Products include Ghost Sqlite3.
How do I fix CVE-2020-24736?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-24736 being exploited?
There is no known exploitation of CVE-2020-24736 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALSA-2023:3840, CLSA-2023-1688069016, CLSA-2023-1688070107, DEBIAN-CVE-2020-24736, GHSA-p8qf-86fr-5x4q, RHSA-2023:3840 and 2 more.