CVE-2017-10989 is a critical heap-based buffer over-read vulnerability in the getNodeSize function of SQLite through version 3.19.3, specifically within its RTree extension. This flaw, also affecting products like GDAL, can be triggered by a crafted database containing undersized RTree blobs. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector, low attack complexity, and potential for high impact on confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, publicly available exploit code in Metasploit or ExploitDB, or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.19.3CPE matchmatch criteria | cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.
Jul 11, 2017sqlite: Heap-buffer overflow in the getNodeSize function
Jul 6, 2017