by Kastro
Paper/Archive/CVE-2019-8457

CVE-2019-8457

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP — SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtre…

EPSS 45%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.8.988 × 2019.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

Affected

ProductAffectedFixed inSource
SQLiteFrom 3.6.0 to 3.27.2 including–CNA
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

advisoryusn.ubuntu.com/4004-1advisoryusn.ubuntu.com/4004-2advisoryusn.ubuntu.com/4019-1advisoryusn.ubuntu.com/4019-2advisorylists.opensuse.org/opensuse-security-announce/2019-06/msg00074.htmladvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3Madvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXHreforacle.com/security-alerts/cpuapr2020.htmlreforacle.com/security-alerts/cpujul2020.htmlreforacle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlreforacle.com/security-alerts/cpujan2020.htmlrefsqlite.org/src/info/90acdbfce9c08858refsqlite.org/releaselog/3_28_0.htmlrefsecurity.netapp.com/advisory/ntap-20190606-0002refkc.mcafee.com/corporate/index?page=content&id=SB10365refcert-portal.siemens.com/productcert/html/ssa-398330.html