CVE-2023-7104
SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow
- Published
- Updated
- Reserved
- Assigned by
- VulDB
Description
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.
Timeline
ID reserved
By VulDB
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulDBCNA (assigner) | 3.1 | Medium5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| VulDBCNA (assigner) | 3.0 | Medium5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| VulDBCNA (assigner) | 2.0 | Medium5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P |
| NVDNVD · Modified | 3.1 | High7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
- EPSS (exploitation in 30 days)
- 1.5% · top 26% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Weakness
Affected products
- affected 3.0
- affected 3.1
- affected 3.2
- affected 3.3
- affected 3.4
- affected 3.5
- affected 3.6
- affected 3.7
- affected 3.8
- affected 3.9
- affected 3.10
- affected 3.11
- affected 3.12
- affected 3.13
- affected 3.14
- affected 3.15
- affected 3.16
- affected 3.17
- affected 3.18
- affected 3.19
- affected 3.20
- affected 3.21
- affected 3.22
- affected 3.23
- affected 3.24
- affected 3.25
- affected 3.26
- affected 3.27
- affected 3.28
- affected 3.29
- affected 3.30
- affected 3.31
- affected 3.32
- affected 3.33
- affected 3.34
- affected 3.35
- affected 3.36
- affected 3.37
- affected 3.38
- affected 3.39
- and 4 more
References (12)
- https://vuldb.com/?id.248999 (opens in a new tab)vdb-entrytechnical-descriptionx_transferred
- https://vuldb.com/?ctiid.248999 (opens in a new tab)signaturepermissions-requiredx_transferred
- https://sqlite.org/forum/forumpost/5bcbf4571c (opens in a new tab)relatedx_transferred
- https://sqlite.org/src/info/0e4e7a05c4204b47 (opens in a new tab)patchx_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/ (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20240112-0008/ (opens in a new tab)x_transferred
- https://lists.debian.org/debian-lts-announce/2024/09/msg00050.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-000297.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-915275.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-277137.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-7104)Record last updated .