CVE-2015-7036
SQLite fts3_tokenizer Untrusted Pointer Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.
La función fts3_tokenizer en SQLite, como se usa en Apple iOS en versiones anteriores a 8.4 y OS X en versiones anteriores a 10.10.4, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (caída de aplicación) a través de un comando SQL que desencadena una llamada API con un valor de puntero manipulado en el segundo argumento.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SQLite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of the fts3_tokenizer function. The issue lies in the optional second argument which is expected to be a pointer into a structure. An attacker can leverage this vulnerability to achieve code execution under the context of the current process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-09-16 CVE Reserved
- 2015-11-18 CVE Published
- 2024-08-06 CVE Updated
- 2024-09-11 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://zerodayinitiative.com/advisories/ZDI-15-570 | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://support.apple.com/kb/HT204941 | 2017-07-01 | |
| http://support.apple.com/kb/HT204942 | 2017-07-01 | |
| https://security.gentoo.org/glsa/201612-21 | 2017-07-01 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | <= 10.10.3 Search vendor "Apple" for product "Mac Os X" and version " <= 10.10.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | <= 8.3 Search vendor "Apple" for product "Iphone Os" and version " <= 8.3" | - |
Affected
| ||||||