CVE-2024-0232: Sqlite: use-after-free bug in jsonparseaddnodearray
A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.
Other sources
Flaw was patched in v3.43.2. Reference: https://sqlite.org/forum/forumpost/4aa381993a
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0232?
CVE-2024-0232 is considered a high severity vulnerability due to its potential to cause application crashes and denial of service.
How do I fix CVE-2024-0232?
To fix CVE-2024-0232, update SQLite to version 3.43.2 or later.
What systems are affected by CVE-2024-0232?
CVE-2024-0232 affects SQLite versions prior to 3.43.2, particularly on Red Hat Enterprise Linux 8.0, Red Hat Enterprise Linux 9.0, and Fedora 39.
What type of issue is CVE-2024-0232?
CVE-2024-0232 is a heap use-after-free issue identified in the jsonParseAddNodeArray() function of SQLite.
Can CVE-2024-0232 be exploited remotely?
CVE-2024-0232 requires local access for exploitation as it involves the victim passing malicious input to the application.