cve/2015/CVE-2015-3414.md

CVE-2015-3414

Description

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.

POC

Reference

• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Github

• https://github.com/ARPSyndicate/cvemon