Description
A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | sqlite | < 3.43.2 | 3.43.2 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | 3.43.2-1 | — |
| Debian 13 | sqlite3 | 3.43.2-1 | — |
Advisories 20
- WID-SEC-2025-0135 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- SSA-794697 SSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2024-1655 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- ICSA-25-100-02 Siemens SIDIS Prime CISA ICS & IT advisories · May 6, 2025
- ICSA-24-319-01 Siemens RUGGEDCOM CROSSBOW CISA ICS & IT advisories · May 6, 2025
- NCSC-2025-0106 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Apr 8, 2025
- SSA-277137 SSA-277137: Multiple Vulnerabilities in SIDIS Prime Before V4.0.700 Siemens ProductCERT · Apr 8, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- SSA-000297 SSA-000297: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller Before V5.6 Siemens ProductCERT · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- NCSC-2024-0416 Kwetsbaarheden verholpen in Oracle Financial Services Applications NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0412 Kwetsbaarheden verholpen in Oracle Peoplesoft NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3222 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-3192 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- NCSC-2024-0304 Kwetsbaarheden verholpen in Oracle PeopleSoft NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0293 Kwetsbaarheden verholpen in Oracle Communications Applications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1643 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- ICSA-23-166-11 Siemens SIMATIC S7-1500 TM MFP Linux Kernel CISA ICS & IT advisories · Apr 9, 2024
References
- https://access.redhat.com/security/cve/CVE-2024-0232 vdb-entry
- RHBZ#2243754 issue-tracking