REDHAT-BUG-2487258: Buffer Overflow
SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications using SQLite versions before 3.53.2 are exposed when they open an attacker-supplied database containing malformed FTS5 page data and execute an FTS5 MATCH query against it.
What does an attacker need to trigger the issue?
The attacker needs to supply a crafted SQLite database with malformed FTS5 page data. Exploitation is triggered when the application runs an FTS5 MATCH query against that database.
What is the practical impact if exploitation succeeds?
The malformed data can cause process crashes, memory exhaustion, or arbitrary code execution through an out-of-bounds read or heap buffer overflow in the FTS5 extension.