Full Disclosure mailing list archives
Re: several issues in SQLite (+ catching up on several other bugs)
From: Paul Vixie <paul () redbarn org>
Date: Tue, 14 Apr 2015 11:38:47 -0700
Michal Zalewski wrote:
... Because of its versatility, SQLite sometimes finds use as the mechanism behind SQL-style query APIs that are exposed between privileged execution contexts and less-trusted code. One example of this is the WebDB / WebSQL mechanism available in some browsers; in this setting, vulnerabilities in the SQLite parser can open up the platform to attacks. Anyway, long story short, I recently reported around 22 bugs in the query parser, including the use of uninitialized memory when parsing collation sequences: ...
thanks for this work, and this report. if anyone has a pointy-haired-boss who wonders about the impact of this disclosure, i offer: http://queue.acm.org/detail.cfm?id=2721993 -- Paul Vixie _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- several issues in SQLite (+ catching up on several other bugs) Michal Zalewski (Apr 14)
- Re: several issues in SQLite (+ catching up on several other bugs) Paul Vixie (Apr 14)
- Re: several issues in SQLite (+ catching up on several other bugs) Hanno Böck (Apr 16)
- Re: several issues in SQLite (+ catching up on several other bugs) jungle Boogie (Apr 19)
- Re: several issues in SQLite (+ catching up on several other bugs) Michal Zalewski (Apr 19)
- Re: several issues in SQLite (+ catching up on several other bugs) jungle Boogie (Apr 19)
- Re: several issues in SQLite (+ catching up on several other bugs) Jeffrey Walton (Apr 19)
- Re: several issues in SQLite (+ catching up on several other bugs) Michal Zalewski (Apr 19)
- Re: several issues in SQLite (+ catching up on several other bugs) Jeffrey Walton (Apr 19)
- Re: several issues in SQLite (+ catching up on several other bugs) Michal Zalewski (Apr 19)
- Re: several issues in SQLite (+ catching up on several other bugs) Reed Loden (Apr 20)