Threats Tagged 'cve-2025-3277'

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498) * SQLite: integer overflow in SQLite (CVE-2025-3277) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An integer overflow vulnerability exists in SQLite's concat_ws() function, leading to a heap buffer overflow of approximately 4GB. This occurs because a truncated integer is used for buffer allocation, but the original size is used when writing data, causing memory corruption. This flaw can result in arbitrary code execution. The vulnerability affects specific versions of SQLite and Node.js packages on Red Hat Enterprise Linux 8. A security update addressing this issue is available from Red Hat.

An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.

MediumVulnerabilityGermanyFranceItaly+7#cve#cve-2025-3277#cwe-122