High severity · published Dec 25, 2023
CVE-2023-7104
SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow
7.3
CVSS
1.5%
EPSS
No
On KEV
Description
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
SQLite3 · SQLite
3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +34 more · source: vendor
FE
Fedora · Fedoraproject
38; 39 · source: NVD
SQ
Sqlite · Sqlite
through 3.43.0 · source: NVD
RC
RUGGEDCOM CROSSBOW Station Access Controller (SAC) · Siemens
before V5.6 · source: CISA
SP
SIDIS Prime · Siemens
before V4.0.700 · source: CISA
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
before V1.1 · source: CISA
In the news
VulnerabilityCritical
ABB B&R Automation Studio
View CSAF
Summary
ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that replaces an outdated third-party component. Although no successful exploitation was observed during testing of the affected B&R products, the identified vulnerabilities could present potential attack vectors that might enable unauthorized access, data exposure, or remote code execution.
The following versions of ABB B&R Automation Studio are affected:
B&R Automation Studio <6.5, 6.5 (CVE-2025-6965, CVE-2025-3277, CVE-2023-7104, CVE-2022-35737, CVE-2020-15358, CVE-2020-13632, CVE-2020-13631, CVE-2020-13630, CVE-2020-13435, CVE-2020-13434, CVE-2020-11656, CVE-2020-11655, CVE-2019-19646, CVE-2019-19645, CVE-2019-8457, CVE-2018-20506, CVE-2018-20505, CVE-2018-20346, CVE-2018-8740, CVE-2017-10989, CVE-2016-6153, CVE-2015-6607, CVE-2015-5895, CVE-2015-3717, CVE-2015-3416)
CVSS
Vendor
Equipment
Vulnerabilities
v3 9.8
ABB
ABB B&R Automation Studio
Numeric Truncation Error, Heap-based Buffer Overflow, Improper Restriction of Operations within the Bounds of a Memory Buffer, Out-of-bounds Write, NULL Pointer Dereference, Incorrect User Management, Use After Free, Integer Overflow or Wraparound, Improper Check for Unusual or Exceptional Conditions, Uncontrolled Recursion, Out-of-bounds Read, Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Buffer ...
May 21, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-7104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-7104
Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/
Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/
security.netapp.com
https://security.netapp.com/advisory/ntap-20240112-0008/
Exploit
https://sqlite.org/forum/forumpost/5bcbf4571c
Patch
https://sqlite.org/src/info/0e4e7a05c4204b47
Permissions Required
https://vuldb.com/?ctiid.248999