Vulnerability Description
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sqlite | Sqlite | 3.36.0 |
| Oracle | Zfs Storage Appliance Kit | 8.8 |
| Apple | Iphone Os | < 16.0 |
| Apple | Macos | < 13.0 |
| Apple | Tvos | < 16.0 |
| Apple | Watchos | < 9.0 |
References
- http://seclists.org/fulldisclosure/2022/Oct/28Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/39Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/41Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/47Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/49Mailing ListThird Party Advisory
- https://support.apple.com/kb/HT213446Third Party Advisory
- https://support.apple.com/kb/HT213486Third Party Advisory
- https://support.apple.com/kb/HT213487Third Party Advisory
- https://support.apple.com/kb/HT213488Third Party Advisory
- https://www.sqlite.org/forum/forumpost/718c0a8d17ExploitPatchVendor Advisory
- http://seclists.org/fulldisclosure/2022/Oct/28Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/39Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/41Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/47Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/49Mailing ListThird Party Advisory
FAQ
What is CVE-2021-36690?
CVE-2021-36690 is a vulnerability with a CVSS score of 7.5 (HIGH). A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of...
How severe is CVE-2021-36690?
CVE-2021-36690 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-36690?
Check the references section above for vendor advisories and patch information. Affected products include: Sqlite Sqlite, Oracle Zfs Storage Appliance Kit, Apple Iphone Os, Apple Macos, Apple Tvos.