CVE-2026-119375

Publié : 30 octobre 2026

Modifié : 30 octobre 2026

Score CVSS

5.5

MEDIUM

Description détaillée

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Références et Patchs

https://abraxaslabs.tech/research/sqlite-wal-pagesize https://github.com/sqlite/sqlite https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672 https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e https://sqlite.org/bugs/info/2026-08-17T15:54:41Z https://sqlite.org/releaselog/3_54_0.html https://sqlite.org/src/info/f9b4ee369557c36c https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch

Dernières Vulnérabilités

CVE-2026-91915

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.

VOIR DÉTAILS

CVE-2026-91914

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft.

VOIR DÉTAILS

CVE-2026-91913

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

VOIR DÉTAILS